July - August 2014 by Loss Prevention Magazine

V13.4

LPPORTAL.COM | V13.4 JULY - AUGUST 2014

MAGAZINE

LOSS PREVENTION

MAGAZINE THE VOICE OF LOSS PREVENTION

BUILDING A NEW DEFENSE TEAM MANAGING THE RISKS ASSOCIATED WITH

BUILDING A NEW

DEFENSE TEAM MANAGING THE RISKS ASSOCIATED WITH DATA SECURITY

READ HAYES: FROM STORE DETECTIVE TO RESEARCH SCIENTIST THE CHALLENGES OF DEALING WITH DATA BREACHES LPPORTAL.COM

ACTIVE SHOOTER: IS HAVING A PLAN ENOUGH?

LPM 0714-A.indd 1

7/22/14 10:16 AM

LPM 0714-A.indd 2

7/22/14 10:16 AM

Android App? Yep, we got it. Program Dashboard

Active Status Map

Tardy Notifications

Live Incident Reporting

Real-Time Stats

Daily Emergency Assignment Summary

The Protos Advantage

Protos Client Portal

Protos Security specializes in placing security guards nationwide, but it’s our management tools, included for free, that make the difference. Our advanced technology geolocates each guard during clock-in and clock-out, and automatically streamlines the flow of critical information throughout your organization. Last year we revolutionized the security guard industry with our mobile app for Apple devices. Now we are proud to announce the imminent release of the same industry leading technology for Android mobile devices.

It’s time to guard better with Protos.

866.403.9630 • www.protossecurity.com LPM 0714-A.indd 3

7/22/14 10:16 AM

CONTENTS 6 PUBLISHER’S LETTER Loss Prevention’s Role in Data Security By Jack Trlica

Building a New Defense Team

8 ON THE WEB 10 RETAIL SPONSORS

Managing the risks associated with data security

12 INTERVIEWING Preparing the Final Statement By David E. Zulawski, CFI, CFE and Shane G. Sturman, CFI, CPP

By Jacque Brittain, LPC, Editorial Director, Digital

24 CERTIFICATION Education Is Now More Affordable for Veterans By John Clark

From Store Detective to Research Scientist

36 DIGITAL DIALOGUE Staying Informed: Is It Really That Important? By Jacque Brittain, LPC

A conversation with Read Hayes of the LPRC

48 ASK THE EXPERT Data Security: Reaching Beyond Compliance With Paul Murray, Wontok, Inc.

By James Lee, LPC, Executive Editor

56 SOLUTIONS SHOWCASE - Bass Security - Checkpoint - Diebold Security

60 INDUSTRY NEWS - Yearning for a Different Job? - Background Screening Benchmarking Report - U.S. Retail Fraud Survey By Robert L. DiLonardo

The Challenges in Dealing with Data Breaches

61 PRODUCT SHOWCASE

A cybersecurity panel discussion

Moderated by Ryan Knisley, Accenture

62 CALENDAR 62 PEOPLE ON THE MOVE

64 ADVERTISER DIRECTORY

Active Shooter: Is Having a Plan Enough?

65 VENDOR SPONSORS 66 PARTING WORDS The Expert That Lives Within Each of Us By Jim Lee, LPC

Recommendations for how retailers should manage the risk

By Jacque Brittain, LPC, Editorial Director, Digital

LPM 0714-A.indd 4

JULY - AUGUST 2014

LPPORTAL.COM

7/22/14 10:16 AM

11 10 of the top 50 retailers

use the retail equation to improve their return processes.

Leading retailers choose The Retail Equation to improve the customer experience at the return counter. Driven by predictive analytics, your return processes become more flexible and friendly while still managing risk and preventing abuse. See how leading retailers are optimizing returns at www.theretailequation.com/success or call us at +1-888-371-1616 to learn more. LPM 0714-A.indd 5

7/22/14 10:16 AM

PUBLISHER’S LETTER

Loss Prevention’s Role in Data Security

MAGAZINE

that most retailers have had in place for years. The panel discussion included a representative from the Secret Service who also emphasized the importance of partnering with law enforcement before a data breach. You may be asking why loss prevention professionals should be reading about information security, which is typically the responsibility of the IT department? LP can provide a great deal of expertise to the corporation when it comes to data security. LP already has strong law enforcement partnerships on the local, state, and federal levels that can be leveraged for data security. LP already has strong physical protection experience that can be leveraged for protecting the physical assets where data resides in stores and headquarters. LP already has strong investigative skills to help determine how and why a data breach occurred. Finally, LP already has experience in writing or assisting in the planning and training for many corporate risk-management issues. All of this LP experience should be leveraged by retailers to ensure they have the best data-security plan in place no matter on whose desk the final responsibility lies. In my observations of LP practitioners over the past twenty-plus years, LP departments have continually offered added-value to their corporations in multiple ways. Data security is another way LP can…and should…play an integral role in the retail organization. Another feature article, “The Challenges in I suspect that many of our forward-looking LP Dealing with Data Breaches” on page 39, includes executives are already involved. We would love excerpts from a cybersecurity panel discussion at to hear from those who could provide insights the Retail Industry Leaders Association (RILA) to our readers on how they have gotten involved asset protection conference in April. The panel included experts from both the private and public and suggestions for ways to add value to the sectors who offered frank suggestions for preparing organization. If you are someone who is already for data breaches and responding to them “when, contributing to your company’s data-security program, please contact us. We would love to add not if” they occur. In our second edition of a new Ask the Expert your voice to this discussion. If you are not involved yet, contact your IT column on page 48, we had a Q&A with Paul peers to offer your expertise. Murray of Wontok, Inc. to get his perspective on building a relationship between LP and IT. All of these presentations and articles underscore how retailers should be partnering internally to build a data-protection plan similar to Jack Trlica the disaster recovery and business continuity plans Editor and Publisher ata breaches and cybersecurity are hot topics in both the press and our industry. Every LP trade show we attended this year featured one or more presentations on data security. In this edition of the magazine, we are adding to the conversation with several articles. The cover story entitled “Building a New Defense Team” features interviews with several experts who presented at the National Retail Federation’s (NRF) LP conference in June as well as others involved in cybersecurity. Jac Brittain’s article discusses a number of issues important to retailers who may or may not have a strong information-protection plan in place.

LP departments have continually offered added-value to their corporations in multiple ways. Data security is another way LP can…and should…play an integral role in the retail organization.

LossPrevention, LP Magazine, and LP Magazine EU are service marks owned by the publishers and their use is restricted. All editorial content is copyrighted. No article may be reproduced by any means without expressed, written permission from the publisher. Reprints or PDF versions of articles are available by contacting the publisher. Statements of fact or opinion are the responsibility of the authors and do not necessarily represent the opinion of the publishers. Advertising in the publication does not imply endorsement by the publishers. The editor reserves the right to accept or reject any article or advertisement.

LPM 0714-A.indd 6

JULY - AUGUST 2014

700 Matthews Mint Hill Rd, Ste C Matthews, NC 28105 704-365-5226 office, 704-365-1026 fax EDITOR AND PUBLISHER Jack Trlica JackT@LPportal.com EXECUTIVE EDITOR James Lee, LPC JimL@LPportal.com EDITORIAL DIRECTOR, DIGITAL Jacque Brittain, LPC JacB@LPportal.com CONTRIBUTORS Robert L. DiLonardo Dave DiSilva Read Hayes, Ph.D., CPP Richard C. Hollinger, Ph.D. Walter Palmer, CFI, CPP, CFE Gene Smith, LPC Shane G. Sturman, CFI, CPP David E. Zulawski, CFI, CFE CHIEF OPERATING OFFICER Kevin McMenimen, LPC KevinM@LPportal.com DIRECTOR OF MARKETING Merek Bigelow MerekB@LPportal.com DIRECTOR OF DIGITAL OPERATIONS John Selevitch JohnS@LPportal.com SPECIAL PROJECTS MANAGERS Kat Houston Justin Kemp Karen Rondeau DESIGN & PRODUCTION SPARK Publications info@SPARKpublications.com 704-844-6080 CREATIVE DIRECTOR Larry Preslar ADVERTISING

ADVERTISING MANAGER Bonnie Dodson 828-479-7472 office 704-943-5797 fax BonnieD@LPportal.com WEST COAST REP Ben Skidmore 972-587-9064 office 972-692-8138 fax BenS@LPportal.com SUBSCRIPTION SERVICES

NEW OR CHANGE OF ADDRESS myLPmag.com POSTMASTER Send change of address forms to Loss Prevention Magazine P.O. Box 92558 Long Beach, CA 90809-2558 LossPrevention aka LP Magazine (USPS 000-710) is published bimonthly by Loss Prevention Magazine, Inc., 700 Matthews Mint Hill Rd, Ste C, Matthews, NC 28105. Print subscriptions are available free to qualified loss prevention and associated professionals in the U.S. and Canada at www.myLPmag.com. The publisher reserves the right to determine qualification standards. International print subscriptions are available for $99 per year payable in U.S. funds at www.LPportal.com. For questions about subscriptions, contact circulation@LPportal.com or call 888-881-5861. Periodicals postage paid at Matthews, NC, and additional mailing offices.

LPPORTAL.COM

7/22/14 10:16 AM

axis_ad

That guy’s BMI just hit the roof.

Visit Axis at ASIS: Booth #1023 Atlanta, GA Sept 29-Oct 1

Be the first to know.

Read more with your smartphone

shed ews ons ated com. n for . For rtal.com ws, NC,

The more you can protect your store’s assets, the less you lose. Now you can use network video to prevent losses due from shoplifting, theft and fraud in your stores. It’s all made possible with high quality video feeds, real time alarms and other smart features in Axis’ leading network video solutions for retailers.

This is just one way Axis’ IP solutions help retail stores minimize loss and maximize profits. Be the first to know how to stay one step ahead. Visit www.axis.com/retail

Axis network video solutions for retail integrate our leading network cameras with specially-designed applications from our partners. • Outstanding HDTV image quality • Integration to your existing POS, EAS and IP systems • Scalable, future-proof solutions from standardized equipment

Inc.

LPM 0714-A.indd 7 axis_ad_retail-lp_lossprev_fpc_us_1406.indd 1

7/22/14 10:16 AM 16/06/2014 11:05:12 AM

ON THE WEB

EYEONLP Powered by LP Magazine

EDITORIAL BOARD

Didn’t have a chance to attend NRF’s loss prevention conference this year? Don’t worry, we have you covered with daily recaps from the show on our EyeOnLP page at LPportal.com.

Leo Anguiano, LPC Senior Director, Asset Protection Rite Aid

Karl Langhorst, CPP, CFI Corporate Director, Loss Prevention, The Kroger Co.

Jim Carr, CFI Director, International Loss Prevention, Rent-A-Center

Bob MacLea Senior Vice President, Loss Prevention, TJX

Francis D’Addario Emeritus Faculty Member, Strategic Influence and Innovation, Security Executive Council

John Matas Vice President, Loss Prevention, Investigations, & Technology, Macy’s

Charles Delgado, LPC Vice President, Asset Protection, Meijer

Also, preview the upcoming Restaurant Loss Prevention & Security Association (RLPSA) conference August 3 – 6 at the Caribe Royale Hotel in Orlando with Keith O’Brien.

Patti Felz Vice President, Loss Prevention, Polo Ralph Lauren Scott Glenn Chief Security Officer, Sears Holdings Tim Gorman Divisional Vice President, Loss Prevention, Asset Protection and Business Continuity, Walgreens

Exclusive Offer for Magazine Readers

Barry Grant Chief Operating Officer, Canadian Images

We recently partnered with the Cyber Security Summit to offer magazine readers 50 percent off conference passes for their upcoming summit September 18th in New York City. The Cyber Security Summit is an exclusive conference series connecting C-level and senior executives responsible for protecting their companies’ critical infrastructures with cutting-edge technology providers and renowned information security experts. Visit cybersummitusa.com to learn more and use promo code LPMAG to receive a 50 percent off registration discount.

Bill Heine Senior Director, Global Security, Brinker International Sonya Hostetler Vice President, Asset Protection & Safety, Walmart Stores U.S.

The LP Magazine App Provides the Latest Industry News Whenever You Want It Be on the lookout in the coming months for the next version of the LP Magazine app. Included in the next update is even more access to original content, video, podcasts, new content areas, and much more from LP Magazine. It’s available for both iPhone and Android devices. Download it today from your favorite app store.

LinkedIn Group

Powered by LP Magazine LinkedIn is not only a place for networking and connecting with individuals across our profession, but it’s also a forum for group discussions. So, let’s get talking, sharing ideas, and collaborating. Our group, Powered by LP Magazine, is growing daily. Join in the conversation. We want to hear from you.

LPM 0714-A.indd 8

JULY - AUGUST 2014

Chris McDonald Senior Vice President, Loss Prevention, Compass Group NA Randy Meadows Senior Vice President, Loss Prevention, Kohl’s Melissa Mitchell Director of Loss Prevention, LifeWay Christian Stores Dan Provost, LPC Vice President, Global Loss Prevention, Staples Tina Sellers Director of Loss Prevention, Delhaize America Mark Stinde Vice President, Asset Protection, 7-Eleven Paul Stone, LPC Vice President, Loss Prevention and Risk Management, Best Buy

Frank Johns, LPC Chairman, The Loss Prevention Foundation

Claude Verville, LPC Vice President, Loss Prevention, Safety & Hazmat, Lowe's

Gary Johnson Vice President, Loss Prevention, The Vitamin Shoppe

Stanley Welch, LPC Vice President, Director of Loss Prevention, JCPenney

Paul Jones, LPC Senior Director, Global Asset Protection, eBay

Keith White, LPC Senior Vice President, Loss Prevention and Corporate Administration Gap Inc.

LPPORTAL.COM

7/22/14 10:16 AM

CEC Ad

Partnering with retailers to reach new heights.

CEC has given Loss Prevention programs 85% of its time back without increasing costs. Optimizing a technology driven solution while streamlining the apprehension process, leading retailers have seen an increase of 80% in overall restitution. Talk to us to understand how to become one of our partners in reaching new heights. Find out more about the CEC Movement. #LeadingTheChange

facebook twitter instagram linkedin

www.CorrectiveEducation.com

LPM Ad 0714-A.indd 9 CEC July2014 FINAL.indd 1

Reinventing the way petty crimes are handled

7/22/14 AM 7/11/14 10:16 2:48 PM

RETAIL SPONSORS

LPM 0714-A.indd 10

JULY - AUGUST 2014

LPPORTAL.COM

7/22/14 10:16 AM

Join these great companies as an LP Magazine corporate sponsor. Email JackT@LPportal.com for more information. LP MAGAZINE | JULY - AUGUST 2014

LPM 0714-A.indd 11

7/22/14 10:16 AM

INTERVIEWING

Preparing the Final Statement O

ne of the most common complaints we hear from senior loss prevention executives is the lack of a quality final statement detailing admissions the employee made during the interview. Since the final statement is representative of the admissions and confessions made during the interview, it is essential that it be as detailed as possible, containing the elements of the crime or policy violation, and clearly substantiating the associate’s admissions. Depending on the organization’s preferences, the final statement could take a number of different forms. Narrative. The narrative statement is generally a handwritten document prepared by the employee detailing his or her admissions. The narrative statement is often called a “letter of explanation” and has the form and appearance of a letter. Question and Answer. The question-answer statement contains the question asked by the interviewer followed by the employee’s answer to the question. This type of statement generally takes longer to prepare since the question must be typed or handwritten prior to inserting the employee’s response. Preprinted Fill-in-the-Blank. This type of final statement is an attempt by organizations to standardize the appearance and content of the employees’ admissions. These types of documents generally have a number of preprinted paragraphs and sentences containing spaces for the employee to fill in his admissions of theft or other dishonesty. Often these types of statements also have a location for the employee to add a small narrative expressing his regret for his actions. Investigator-Written Statement. The interviewer or investigator uses the employee’s admissions or explanations to write a statement detailing them that the employee signs upon completion. Generally, this format is similar to the narrative except that it is prepared by the interviewer rather than written by the employee. This statement is often used in situations where the employee cannot write or is reluctant to write a statement on his own. Audio/Video Statement. With the advent of digital recorders and the proliferation of telephone interviewing, some organizations utilize an audio recording of the employee’s statement. This is generally done at the conclusion

LPM 0714-A.indd 12

JULY - AUGUST 2014

by David E. Zulawski, CFI, CFE and Shane G. Sturman, CFI, CPP

Zulawski and Sturman are executives in the investigative and training firm of Wicklander-Zulawski & Associates (w-z.com). Zulawski is a senior partner and Sturman is president. Sturman is also a member of ASIS International’s Retail Loss Prevention Council. They can be reached at 800-222-7789 or via email at dzulawski@w-z.com and ssturman@w-z.com. © 2014 Wicklander-Zulawski & Associates, Inc.

of the interview where the associate reiterates his admission and substantiates it orally for recording on an audio device. This recording is then either transcribed or simply stored in a case management program as part of the file. Regardless of which form of the statement a company chooses to use, its content and format should remain fairly consistent in each of the above types of documented statements.

Organizing the Statement

The preparation for a well-organized statement begins as the interviewer plans for the interview. The interviewer should determine what proofs will be necessary to establish the criminal act or policy violation. In thefts, the elements of the crime are the intent to permanently deprive the company of its asset and to establish that the asset was owned by the organization. Generally, using the word steal establishes the intent to permanently deprive the owner of his property by its very definition. The interviewer should also consider the personal needs of a decision maker when thinking about the content of the statement. If, for example, human resources wants to be certain that the individual knew that it was wrong to steal, then this should also be included in the statement to satisfy their needs. A simple statement such as, “I knew that it was wrong to steal from the company and also a violation of the law.” This statement is generally sufficient to satisfy anyone that the employee knew his actions were inappropriate. Once the development of the admission has been completed, the interviewer should have their own notes detailing the admissions of the employee. These notes can be used in two ways. First, the interviewer may use the notes as another form of documentation by having the employee initial the various admissions attesting to their correctness. The interviewer’s notes are then signed by the employee and dated. These notes then become part of the investigative case file to support the final statement. Second, these notes are used by the interviewer to help format the final statement, making sure that all the details and admissions made by the employee are included in the final statement. continued on page 14 |

LPPORTAL.COM

7/22/14 10:16 AM

LPF_04

A STRATEGIC PARTNERSHIP BUILT ON ENGAGEMENT. AMU AND THE LOSS PREVENTION FOUNDATION

As a strategic partner, American Military University is proud to offer the following to The Loss Prevention Foundation members: • B.A. in Security Management with a concentration in Retail Loss Prevention • Transfer Credit Evaluation fee waivers • Transfer Credits for LPC and LPQ certifications • 100% online convenience • 8-week courses that start monthly • Undergraduate costs roughly 20% lower than average in-state rates at public universities* • E-books and other required course reading materials at no cost for undergraduate-level courses for credit

Visit us at www.AMUonline.com/LPF SM

*Based on published rates provided by College Board: Trends in College Pricing, 2013.

LPM 0714-A.indd1 13 LPF_0414.indd

7/22/14 AM 4/14/14 10:16 4:19 PM

continued from page 12

In most cases the employee’s statement is organized in the following manner: 1. The document is dated with the current date when it was prepared. Often the time it began and was completed is included. 2. The first paragraph in the document is used to identify the individual and establish their biographical information. At a minimum this should include the individual’s name, position and tenure within the organization, plus the location of assignment. This establishes their role as an employee and the venue of the incident if a criminal complaint is going to be contemplated. Some organizations include other biographical information, such as the associate’s address, employee identification number, or other personal information. 3. The document’s second paragraph is a summary of the admission made by the employee during the interview. This summary is not a substantiated or detailed admission, but rather an overview of what is to come. For example, the associate might write, “I stole $300 in merchandise and $200 in money from [insert company name] store 5295.” 4. I n the subsequent paragraphs the employee substantiates each of the previous paragraph’s broad admissions. For example, if the employee had admitted stealing $100 in cash from his terminal and another $100 using fraudulent refunds, there would be two paragraphs covering these theft admissions. This would then be followed by the substantiation of the $300 in merchandise with as many details as possible relating to the method of the theft, plus the types and quantities of merchandise stolen. 5. There may be other paragraphs that would link documents or evidence to the statement. If the associate had identified refunds he used to steal, it would be useful to have him initial those documents and date them. In this paragraph he would then note that he had identified the fraudulent documents initialing and dating those he identified as using to steal from the organization 6. There may be another paragraph relating to diagrams prepared by the employee to show how he concealed merchandise or removed merchandise from the facility. 7. F ollowing the paragraph substantiating the admission, the employee is encouraged to write his reason for participating in the incidents and to express his regret for his actions if he wishes. Often the employee may choose to write his reasons for becoming involved and detail the personal issues contributing to his dishonesty. 8. This section of the statement establishes its voluntariness. The employee is asked whether the statements he made are true and whether any threats or promises were made to obtain them. His answer to that question is incorporated in this portion of the statement. 9. The employee, interviewer, and witness sign and number each page to include the date and time of the statement’s completion. 10. The employee initials any scratch outs or changes he has made on each of the pages.

LPM 0714-A.indd 14

JULY - AUGUST 2014

One of the most common complaints we hear from senior loss prevention executives is the lack of a quality final statement detailing admissions the employee made during the interview. Since the final statement is representative of the admissions and confessions made during the interview, it is essential that it be as detailed as possible, containing the elements of the crime or policy violation, and clearly substantiating the associate’s admissions. Additional Elements

Regardless of the type of statement chosen by an organization, the format and ultimate content of the final statement can be the same. However, there may be instances where the associate is not being clear in his writing. In these situations the interviewer may find it useful to write five or six specific questions that clearly establish the elements of the crime or policy violation and then ask the associate to write his answers after each question. The interviewer may also find it useful to take a statement from the witness who sat in on the interview. The witness is asked to write a detailed summary of what occurred during the interview, including a description of the interviewer’s and employee’s demeanor. The witness can also initial and sign the interviewer’s notes just as the employee did to attest to their accuracy and completeness. This additional statement will serve to document what went on during the interview and act as a source of review for the witness should he be required to testify. While the formatting and content of the final statement is relatively straightforward, we have not addressed the continued problems of inadequate statements provided by investigators. In our next column we will look at some of the reasons why statements are inadequately prepared and how this might be rectified. One of the areas that we plan to spend a significant portion of the column on is the clarity and meanings of sentences within the final statement. We will focus on how to introduce the written statement, how to format, and obtain the employees cooperation in its preparation. |

LPPORTAL.COM

7/22/14 10:16 AM

COVER FEATURE

BUILDING A NEW

DEFENSE TEAM MANAGING THE RISKS ASSOCIATED WITH DATA SECURITY By Jacque Brittain, LPC, Editorial Director, Digital

LPM 0714-A.indd 15

7/22/14 10:16 AM

BUILDING A NEW DEFENSE TEAM

s technology draws us deeper into a new age of business enterprise, we are continuously bombarded with waves of challenges and opportunities involving those with malicious intentions. These attacks come at us from every direction as the ingenuity of these criminal minds seek new and creative ways to infiltrate our information resources and engage in cyber warfare against our businesses. In order to survive these reprehensible intrusions, retailers must fight back. We have to defend our ground and take the necessary steps to combat the threat. This requires that we build and recruit the resources that will help us win the battles. We must become cyber warriors in our own right; defending our computer and information systems against those seeking to seize and exploit the lifeline of our business.

The Influence of Retail

“Retail is the lifeblood of the American economy,” remarked Michael Chertoff at this June’s National Retail Federation (NRF) LP conference. “Having a safe space to operate is critical to the successful operation of the business.” According to the U.S. Department of Labor, the retail trade sector is the nation’s largest employer, with approximately 15.3 million jobs as of May 2014. Further studies show that total retail sales in the U.S. topped $4.53 trillion in 2013 (EMarketer.com), representing 27 percent of nominal U.S. gross domestic product, or GDP. While no surprise to those leading the industry, these numbers make it quite apparent that cyber threats can not only impact the retail sector, but can also have a substantial influence on the growth and stability of our economy as a whole.

“Data security is about risk management, not risk elimination. There has to be a strategy for managing the risk built on realistic expectations. You have to understand what you’re facing so that you can make intelligent decisions. There must be a full understanding of the threat, of the consequences, and an assessment of the company’s weaknesses and vulnerabilities and how they – Michael Chertoff fit within the business.” Hackers and like-minded mercenaries wage war using information technology to assault our computers and information systems through cyber-related strategies. In the retail space we primarily have thieves looking for personally identifiable information that can be exploited and turned into cash. But there are other groups as well. There are groups targeting organizations for their research-and-development assets, intellectual property, and corporate strategies. There may also be other motivations. To win these wars, we must find better ways to secure our systems by building awareness, educating our teams, finding and closing vulnerabilities, and developing collaborative strategies to protect our resources and defend our customers and our companies. Our greatest opportunity to overcome these intrusions is through a comprehensive approach that includes information sharing and best-practice protocols that support a joint defense team. This is a shared responsibility that will not only demand innovative thinking, but joint cooperation throughout an organization…and the industry. To prevail over this imposing threat to the business, we have to work together. A team is typically at its best when the offense and defense work well together. LP Magazine intends to take this fight to the offensive by providing information and resources that can be used to support our efforts and strengthen our sentinel. In the process we’ve attended multiple seminars and interviewed several industry-leading thought leaders and cybersecurity experts to provide a more comprehensive perspective on the subject.

LPM 0714-A.indd 16

JULY - AUGUST 2014

Chertoff, the former secretary of the U.S. Department of Homeland Security and now the executive chairman and cofounder of the global security advisory firm The Chertoff Group, feels that cybersecurity issues have not received the type of front-line attention that some of the more visible and obvious risks have obtained. With some of the more recent incidents that have brought the issue front and center, it is becoming increasingly clear that these types of threats must become a business priority. “We’ve seen broad exposure of systemic vulnerabilities in our company infrastructures,” Chertoff said. “Businesses are collecting more personal information about customer preferences, locations and behaviors, not to mention credit card numbers. Organized groups have become very sophisticated in their efforts, using strategies that are complex and well-planned.” Did you ever consider that something as simple as a thermostat could leave your company vulnerable to a cyber attack? To help keep customers comfortable and shopping at a store, it’s common for retailers to routinely monitor temperatures and energy consumption in stores to save on costs and to alert store managers if temperatures in the stores fluctuate outside of an acceptable range. Often this process is completed with the assistance of an outside service provider with specific expertise to keep the system efficient and cost-effective. Yet this seemingly mundane, unassuming process opened the door for access into a company’s database, leading to one of the largest, most damaging data breaches in retail history. Whether the vulnerabilities are introduced by employee errors or negligence, disgruntled employees, partnering companies, or |

LPPORTAL.COM

7/22/14 10:16 AM

BUILDING A NEW DEFENSE TEAM some other weak link in our systems or procedures, the risks are formidable, the possibilities are only bound by the creativity of the criminal element, and no business is exempt from the threats. “Data security is about risk management, not risk elimination,” says Chertoff. “There has to be a strategy for managing the risk built on realistic expectations. You have to understand what you’re facing so that you can make intelligent decisions. There must be a full understanding of the threat, of the consequences, and an assessment of the company’s weaknesses and vulnerabilities and how they fit within the business.”

Arming Ourselves with Experts

Many businesses are aggressively pursuing different avenues to improve cyber strategies and provide training and awareness opportunities for company leadership. Industry conferences have taken significant steps to offer quality sessions that provide information, guidance, and direction on cyber-related issues. Companies are bringing in top experts to consult with their teams, perform vulnerability assessments, and educate both staff and company leadership. There are also various conferences held across the country that specifically focus on information-security issues, some intended for industry experts, while others focus on training and education of business leaders at different levels and areas of responsibility. Larger events would include the RSA Conferences, which attract some of the best and brightest in the field through annual conferences in the U.S., Europe, and Asia. Other conferences may

focus on specific or more intimate audiences to heighten awareness and maximize the learning experience, such as the Cyber Security Summit. All of these efforts are intended to improve our skills, keep our professionals connected, and increase awareness of these critical business concerns. “In many ways we have been short-handed when it comes to cyber warriors,” states Ken Fuller, executive vice president for the Cyber Security Summit. “We’ve had tremendous success bridging the gap by bringing in experts and educating leadership regarding what’s going on and how we can better defend ourselves. By identifying and securing thought leaders that can successfully communicate the message, educate them on what to look for, and help determine the weakest link, we can help our enterprises approach technology issues with a broader perspective and a sharper focus.” Fuller adds, “This is a real problem, and every industry is susceptible. Every industry leader has the responsibility to be aware and educated so that they can best protect both the consumers and the company.”

The Veiled Bride

How many of us know that couple where one partner just seems to spark so much in the relationship? The person is fun, charming, and likable—having that special quality that draws others in. They make friends easily. They can lead a conversation, or listen with real or assumed interest even when the subject is so dry and boring that it would drive most of us insane.

shrink got you in a tight spot? Maximize your display opportunities with our Mini Spider Wrap®, the perfect solution for smaller, boxed merchandise. The strong clutch mechanism provides tightly cinched security allowing you to openly display items in the perfect spot and increase your sales. Explore our full line of solutions on our website or call 888.257.4272.

LP MAGAZINE | JULY - AUGUST 2014

LPM 0714-A.indd 17

7/22/14 10:16 AM

Feature 1 BUILDING A NEW DEFENSE TEAM

Hackers and like-minded mercenaries wage war using information technology to assault our computers and information systems through cyber-related strategies. In the retail space we primarily have thieves looking for personally identifiable information that can be exploited and turned into cash. But there are other groups as well. There are groups targeting organizations for their research-anddevelopment assets, intellectual property, and corporate strategies. must reap immediate benefits. As a result the technology can be significantly ahead of the controls. “Security measures can lag behind three to five years,” he added. “A company’s number-one asset is its people. This is a common thread, and a prime opportunity for access. Ninety percent or more of the malware is getting in through social media.” Foster went on to describe a simple scenario as an example. If a hacker wants to break into XYZ Company, they may create an online persona that mirrors the brand’s logo, verbiage, and marketing style. They build the false content using one of many social media platforms, along with a link that says “XYZ Company Rocks.” If an employee were to open the link, it can then open the door for the The Power of Social Media hacker to breach the company. By using web-based and mobile technologies to While it may sound like a simple strategy, turn communication into interactive dialogue, social hackers have become experts at disguising their media creates an effective channel for individuals and intensions—and it may only take one unsuspecting groups of people to connect, interact, create, and share. James Foster employee to be successful. Regrettably, this is only a With businesses constantly positioning to make single, basic example of a problem with prospects only limited by news, build their brands, improve communications, and grow the imagination and ingenuity of the hacker. This is the challenge, their customer base, companies are using email blasts and a and only one of many issues that we can face. plethora of platforms to include Facebook, Twitter, LinkedIn, and YouTube to market their products and services. These powerful communication tools can have significant influence on awareness, Defense in Depth acceptance, and behavior. They play an important role in many So, how do we combat these problems? marketing strategies and are also a common vehicle used by many “Unfortunately, existing plans are ninety percent reactive, which of our employees to network and communicate with one another. is like patching cracks in a dam with bubble gum.” Foster says. Unfortunately, these same resources are opening doors to many of “There has to be a plan, a defense-in-depth strategy that proactively our data-security issues. addresses data security.” In the information world, it’s about firewalls, intrusion-detection systems, two-factor authentication, and encryption. These defenses are layered to make them more resilient. Finding the Weakest Link But there has to be more. Our defenses must include a plan and a “When cybercriminals are looking for ways to breach our partnership that effectively creates a unified team to combat these systems, the starting point to penetrate our information typically threats. This involves a comprehensive approach that would include has nothing to do with the use of credit cards, even when that’s the following: the information that they’re attempting to obtain,” says James Foster, founder and CEO of ZeroFOX in a conversation with ■ A knowledgeable and educated team that communicates well and LP Magazine. “But they have to get in somewhere. So what is the works together. best way in? Attackers will look for the weakest link and a way in ■ A diverse team that can provide different perspectives and offer that exploits or manipulates the system at a point of vulnerability. comprehensive value. They’ll often use tools that have mass adoption—even if it fails a ■ Expert external opinions that provide guidance and will thousand times, the one time it does work gets them in. They are objectively review the plan. looking for a more covert way to get into the system—one where ■ An adequate budget. they can feed on the user’s trust and delay detection. When you put ■ Privacy and compliance policies. it together, the easiest venue to leverage is social media.” ■ A framework and foundation for governance. In our push to get ahead in the highly competitive world “As retailers expand their offerings and push online services, of business, Foster commented that information technologies internal and external policies, roles and synergies must be We find them interesting and attractive in different ways and at different levels. We quickly trust them and believe their sincerity. The other partner may appear cordial and friendly, more reserved or withdrawn, or even more negative or hostile. But this one person brings us together and makes us want to establish a friendship. When it comes to data-security issues, the data breach has that partner—the one that draws us in and seeks out our trust and friendship. In many ways this intimate colleague is critical to the success of both the marriage and the extended relationships—attracting new and unsuspecting individuals on a daily basis. In this partnership the veiled bride is social media.

LPM 0714-A.indd 18

JULY - AUGUST 2014

LPPORTAL.COM

7/22/14 10:16 AM

BUILDING A NEW DEFENSE TEAM American companies, there is even the potential for business strategies, processes, products, and other valued information to be targeted by nation states seeking to pirate intellectual property and related business assets. “There are also many ways that these breaches Building Bridges can occur,” states White. “That’s part of what makes “When it comes to dealing with data-security it such a complex issue. Some methods are fairly issues in the business world, there are basically two unsophisticated, exploiting people’s natural inclination kinds of companies—those that have discovered to trust others, for example. False emails may be sent to that they’ve been breached, and those that have company employees, encouraging the employee to open been breached and don’t know it.” Brian White a file or download a link that allows the criminal to While this may be a strong statement, it offers an back their way into the network and ultimately exposes equally powerful message to the retail community. the business to the intrusive malware—a process commonly We recently sat down with Brian White, who leads the global referred to as ‘spear phishing.’ Other methods may be much more security services business for The Chertoff Group. As previously sophisticated, with the cybercriminals investing in any number of mentioned, The Chertoff Group is a global security advisory firm intricate tools that will allow you to hack into the system.” that provides clients with high-level security strategies that are While such threats can never be eliminated entirely, a key designed to help manage risks and protect against a wide spectrum aspect of any protection policy is managing the potential risks. of business threats. White works with a broad range of clients who This involves understanding where your vulnerabilities may are seeking a new strategic direction to meet their growth objectives. occur, what the potential consequences might be, and working He primarily focuses on cyber-security and innovative technology. together internally as a team to minimize those vulnerabilities. The retail industry has become a primary target for malicious This is where retail must continue to build the bridges within cyber activity, with both individuals and criminal networks our existing infrastructure. trying to steal financial information, identity information, and Throughout the retail environment, the LP and IT departments credit card information. But issues have the potential of going typically have very different roles and responsibilities. Their even deeper. As demonstrated by recent U.S. indictments against functions within the organization are carved from distinctive stones, Chinese military officers accused of stealing trade secrets from reevaluated, and a collaborative security strategy that includes loss prevention absolutely must be part of the conversation,” Foster states. “The success of the organization simply depends on it.”

LP MAGAZINE | JULY - AUGUST 2014

LPM 0714-A.indd 19

7/22/14 10:16 AM

BUILDING A NEW DEFENSE TEAM dissimilar in origin, structure, balance and purpose. In many ways, they even speak different languages. However, there is also common ground and a working relationship based upon shared tasks and accountabilities. It is this relationship that must continue to evolve. “When dealing with data risks in the retail environment, there’s increasingly a link back to the LP teams. The investigation function is particularly valuable, and a unified strategy only makes good sense. For our security functions to be most effective, our professionals must be a collective enterprise,” says White. This requires a comprehensive approach as described here: ■ Recognizing our vulnerabilities to mitigate the risks. This may also include consulting with specialized professionals to establish controls, ascertain roles and responsibilities, and determine effective and efficient protocols. ■ Increased communication and enhanced cooperation. This is a shared responsibility, and must flow both ways. There must be shared perspectives and open channels to build these bridges. ■ Additional training. Everyone responsible for protecting this information must have a strong awareness of the tools and the power of the data, along with the knowledge and skills to manage the risks. With the depth, magnitude, and global reach of several recent breaches as well as the repercussions for the businesses and

Every organization must evaluate their risks and exposures and establish best practices based upon their specific business needs. However, that approach should not focus solely on compliance. What you really have to do is take an active, functional approach to the business, determine the risks, and then make informed, intelligent decisions based on the needs, vulnerabilities, and resources available to the organization.

Perception versus Reality

Recent attacks on retailers, including Target, Neiman Marcus, Michaels, P.F. Chang’s, and others, have focused the attention of the entire retail community on these cyber-incidents over recent months, and all have an important connection in cybersecurity expert and noted blogger Brian Krebs. A journalist and investigative reporter who broke the news on these and several other prominent breaches, Krebs is best known for his coverage of profit-seeking cybercriminals. However, beyond his experience, it is his sharp instincts and insightful approach that help him stand apart. Recently he gave a presentation at the 2014 NRF loss prevention conference and shared some thoughts that should make all of us take notice. When it comes to protecting our critical information, Krebs stressed the concept of perception versus reality—how secure you actually are versus how secure that you think you are.

“Most companies think that the automated tools that they have do a pretty good job at protecting them from these attacks. But where they really need to focus more of their security budgets is on the people to help them interpret all of the stuff that’s being put out, and how to respond to it. Too many organizations spend way too much emphasis on the tools, and not enough on the people.” – Brian Krebs their brands, there is clearly greater awareness to the point that companies have become much more sensitive to the threat. But this awareness must be coupled with continuing education, proactive controls, and actionable plans. “Every company should start with the proactive assumption that their perimeters can and will be breached,” states White. There must be a layered defense that would include the following: ■ Appropriate tagging and classifying of data based on importance and sensitivity. ■ Robust policies and procedures that clearly identify security expectations. ■ Strong password policies, network controls, and access controls to include third-party controls. ■ Maintenance protocols and keeping software up-to-date. ■ Appropriate education and awareness to keep our teams current and informed. ■ A quick and diligent response-and-recovery plan in the event of an intrusion. ■ Continuing and persistent evaluation and updates as necessary and appropriate.

LPM 0714-A.indd 20

JULY - AUGUST 2014

“Most companies think that the automated tools that they have do a pretty good job at protecting them from these attacks,” he says. “But where they really need to focus more of their security budgets is on the people to help them interpret all of the stuff that’s being put out, and how to respond to it. Too many organizations spend way too much emphasis on the tools, and not enough on the people.” Reflecting on several of the incidents that have garnered his energy and attention, Krebs feels that companies typically have all of the information that they need to figure out that they’ve had a breach, but no one is looking at and interpreting that information. He emphasized the importance of communication, teamwork, and talent. He then proposed the following model to guide those efforts: ■ Identify and protect your soft spots—Determine what information that you feel is vital to protect. ■ Know your enemy—Figure out who you’re likely to be targeted by and what information they want. ■ Invest in talent—Too many organizations rely on automation for security rather than talent. Get smarter continued on page 22 |

LPPORTAL.COM

7/22/14 10:16 AM

LPmag-

Loss Prevention

101

LockUp employee lockers are the foundation of a solid loss prevention strategy. Clear, polycarbonate locker doors show everything stored in employee lockers and the patented, manager flex key puts locker control in the hands of store management, not employees. LockUp offers secure, personal storage for employees and concrete loss prevention for stores.

Get a free sample for your store. Scan QR code for qualiﬁcation.

LPM 0714-A.indd 21 LPmag-Lockup-Mon14.indd 1

LockUp by Digilock® lockup.com | 707.766.6000 7/22/14 AM 7/7/14 10:16 4:11 PM

LossPreventionAd.qxp_Layout 1 5/7/14 4:36 PM Page 1

Pocket Sized Radio

BUILDINGBIG A NEW DATADEFENSE TEAM

Fro

Designed Specifically for Loss Prevention • Weighs only 3.9 ounces • 1.5 Watts of transmit power • 4 channels • Long battery life • Up to 5 mile range • Two-year radio warranty

Our greatest opportunity to overcome these intrusions is through a comprehensive approach that includes information sharing and best-practice protocols that support a joint defense team. This is a shared responsibility that will not only demand innovative thinking, but joint cooperation throughout an organization…and the industry. To prevail over this imposing threat to the business, we have to work together. continued from page 20

Actual Size

Two-Way Business Radios

about how you spend your security dollars. For example, few companies have a chief information security officer (CISO). Invest in people and leadership. ■ Look beyond compliance—A primary opportunity lies in a failure to act on information that has already been gathered. “For too many organizations, it takes a major breach to get religion,” he says. Do we really need to experience another incident to find a common creed? When describing himself on his blog, Krebs reveals, “Much of my knowledge about computers and Internet security comes from having cultivated regular and direct access to some of the smartest and most clueful geeks on the planet.” Maybe we should all take his lead.

Moving Forward

www.kenwoodusa.com/protalkinfo

1-800-950-5005

LPM 0714-A.indd 22

JULY - AUGUST 2014

Data security is vital to the success of our businesses in many ways, and every retail professional has a responsibility to remain educated and informed. As the experts are quick to remind us, that means that we must take the steps to listen, as well as to be heard. We have to build partnerships as well as learning opportunities, and work together to find solutions. We must arm ourselves with information, and make swift and sound decisions when called upon. We have to expect the battles, and win the war. For many of us this is new territory. For others it is an opportunity to refocus and remind ourselves of the importance of communication, cooperation, and teamwork. For all of us, it is an essential message that we must always strive to learn, flex, and adapt. We have to look at our teams and our business in a new way. There is a new paradigm in retail, and we’d better step up to the plate. For more on this topic, see our article “The Challenges in Dealing with Data Breaches—A Cybersecurity Panel Discussion” on page 39 from the 2014 Retail Industry Leaders Association (RILA) asset protection conference. |

LPPORTAL.COM

7/22/14 10:16 AM

die1048

IN THE BUSINESS WORLD, SECURITY THREATS ARE VERY REAL. THAT’S WHERE WE COME IN.

Diebold’s integrated security and monitoring solutions have been trusted by financial institutions and commercial enterprises for more than 150 years. It’s who we are. It’s what we do. What can we do for you?

DIEBOLD.COM/LPMAGAZINE

LPM 0714-A.indd 23 die10484-02_Brand Ad_DIAL_LP Mag_v06AR_20140424.indd 1

855.331.0359

7/22/14 10:16 AM 4/24/14 6:35 PM

CERTIFICATION by John Clark Clark is the director of corporate asset protection for Sports Authority, where he is responsible for corporate AP operations and investigations, global supply-chain security, and emergency management operations. Clark also is a board member as well as the retail vice president for the Coalition of Law Enforcement and Retail (CLEAR). He is the committee chairman for the Loss Prevention Foundation’s military transition committee. Prior to his career in the private sector, Clark served in various roles in law enforcement and was a member of the U.S. Air Force. While serving our country, he earned degrees in criminal justice administration and industrial security management from the U.S. Air Force Air University and the Community College of the Air Force.

Education Is Now More Affordable for Veterans

ducation is now more affordable for military veterans inside the LP industry as well as those interested in a career in our industry who are transiting from their military careers. Recently, we were delighted to announce to our veteran community that the Department of Veterans Affairs (VA) has evaluated, approved, and included the exams for first-level LPQualified(LPQ) and the advanced-level LPCertified(LPC), making both exams eligible for G.I. Bill reimbursement. This new financial assistance for veterans is a key component of the LPF’s mission to offer comprehensive, start-to-finish service packages for those desiring a career in this industry. While much has been written on attracting veterans into LP and assisting them with the transition, the Foundation and its military transition committee has also been committed to the professional advancement and assistance of those veterans currently employed in our industry. Our success in having the VA recognize the Foundation’s certification programs was a tremendous achievement. This now provides us with the ability to bring even more value to our transitioning men and women of the military as well as our veteran community; and affords these professionals an opportunity to transition that skill set to organizations that will certainly value the experience and knowledge they bring to the table. One of the many things veterans learn while serving in the military is the importance of possessing an attitude for continuous learning; and how that attitude for learning enhanced their chances for advancement. This attitude is carried over into civilian life by their desire to actively pursue a college degree and professional certification. Recognizing the need to support veterans in their pursuit of a degree, the Foundation established a partnership with the American Military University (with over 65,000 military/ veteran students) and helped to create a concentration in loss prevention. The Foundation also had the LPQ and LPC evaluated for academic credit. By obtaining AMU approval for credit, it allows veterans who are certified to get three free credits towards a bachelor’s degree. Getting free credit hours

LPM 0714-A.indd 24

JULY - AUGUST 2014

simply makes pursuing a degree a little more affordable and helps to demonstrate the value of the certifications. Many military veterans that are already a part of our industry are fortunate to work for companies that eagerly fund tuition reimbursement and professional certification. Unfortunately, others are not so fortunate and do not have the funds to pay for profession certification. Therefore, one of our goals has been to make becoming LPQ and LPC certified more affordable for those wishing to advance their career. That is why the Foundation submitted the LPC and LPQ for VA evaluation and approval. Some retailers pay for both the prep courses and exams. In other situations companies may only pay for the course, while leaving the cost of the exam to the individual. Some retailers may not pay for either due to budget restrictions. Now, the Foundation has helped to make it more affordable for everyone. “The VA funding available for the LPC exam is a path to advance one’s employment in the retail loss prevention profession. Fortune 500 corporations put a premium on the LPC designation, which helps to improve employment opportunities,” said Kevin Lynch, LPC, former Navy Academy graduate and member of Foundation’s military transition committee. “Retail loss prevention has a tremendous need for knowledgeable talent. An industry-specific course such as the LPC really helps the veteran understand the retail business better, allowing them to perform more effectively in their current position. It also demonstrates their continued desire to learn, proves they possess an advance level of retail specific knowledge, and gives them information often not obtained even with twenty-plus years of experience,” said Gene Smith, LPC, president of the Loss Prevention Foundation. It is this not-for-profit organization’s mission to elevate the professionalism of the entire loss prevention industry. The Foundation has many services that help anyone who desires a career in this field or who needs a career boost, including students, those in job transition, those seeking career advancement, retirees, and international LP practitioners. Contact the Foundation to discover the services available to help you grow your loss prevention career.

LPPORTAL.COM

7/22/14 10:17 AM

Christyn Keef, LPC, Walmart

Justin Voss, LPC, Kmart

Jason Lundy, LPC, Walmart

Keith White, LPC, The Gap, Inc.

Kevin Mahoney, LPC, Nike North America

Terrell Williams, LPC, Nike North America

Kevin Martin, LPC

Kevin Wolfe, LPC

Recent LPC Recipients

Donna Matty, LPC

James Woolverton, LPC, 7-Eleven

Sharjeel Ahmad, LPC, Walgreens

Corey May, LPC, Nike North America

Eric York, LPC, Lowe’s

Raymond Aldaco, LPC, Nike North America

Doug McKendry, LPC, Nike North America Clint Middlebrooks, LPC, Lowes Companies

Recent LPQ Recipients

Mattia Bartolini, LPC, Nike North America Briana Burgess, LPC, Nike North America

Tamara Murray, LPC, Walmart

Kenneth Carter, LPC, Walmart

Thomas Nickel, LPC, Family Dollar

Matthew Brazaitis, LPQ, American Eagle Outfitters

Jacklyn Cato, LPC, Cracker Barrel Old Country Store

Toby Norton, LPC, Walmart

Kenneth Carlson, LPQ, Lowe’s

Ted Nosek, LPC

Edward Collins, LPQ, Simmons Foods

Justin Ciampi, LPC, Rite Aid

Adam Oberdick, LPC, Nike North America

David DeSousa, LPQ, United Technologies

Frank Dara, LPC, Nike North America

Mark Obert, LPC, Rite Aid

Frances Egbert, LPQ, Macy’s

Frederick Dunn, LPC, Nike North America

Jessica Pierce, LPC, DICK’S Sporting Goods

Sarah Hammel, LPQ, Nike North America

Adam Ennis, LPC, Cabela’s

Chuck Posey, LPC, Office Depot

Devin King, LPQ, Hermes of Paris

Robert Frasco, LPC, Nike North America

Joshua Rea, LPC, Nike North America

Kevin New, LPQ, 7-Eleven

Benjamin Friedman, LPC, Walmart

Jesus Ramirez, LPQ, Hermes of Paris

John Gammon, LPC, Big Lots

Patty Rhodes, LPC, Goodwill Industries of Central Indiana

Frank Gassmann, LPC, Walmart

Carol Rusinko, LPC, Nike North America

Jude Rosagaron, LPQ, Goodwill Industries of Seattle

Timothy Hall, LPC, 7-Eleven

Barry Smith, LPC, Nike North America

Eric Roth, LPQ, Nike North America

Tony Hiatt, LPC, Lowes Foods

Curt Steele, LPC, Nike North America

Pradeep Sengupta, LPQ, Garda

Becky Hillyer, LPC, Walgreens

Steven Sturgill, LPC, 7-Eleven

Yiu Ho, LPC, Nike North America

Karl Suhanyi, LPC, 7-Eleven

Robert Walker, LPQ, Goodwill Industries International

Elena Hollenbeck, LPC, Nike North America

Susan Torell, LPC, HUGO BOSS Fashions

Tracy Johnson, LPC, Nike North America

Doug Victer, LPC, Marshalls

Newly Certified

Following are individuals who recently earned their certifications.

Kwame Acree, LPQ, Hermes of Paris

Ann Morin Youssef, LPQ, American Eagle Outfitters

ONE SOURCE

MORE SOLUTIONS North America’s only one-touch solution for loss prevention, new construction and facilities with nearly 40 years of service to the retail market.

Providing 24/7 service, repair and emergency response 888.774.3400 | sales@bass-security.com

LP MAGAZINE | JULY - AUGUST 2014

LPM 0714-A.indd 25

OFFERING A FULL LINE OF THE LATEST PRODUCTS AND TECHNOLOGIES – Analog and IP Video – Access Control – Intrusion and Fire Systems – Electronic Article Surveillance – Locks and Keys – Doors and Frames – Door Hardware visit us at www.bass-security.com

7/22/14 10:17 AM

Contact_singlePageAD_FINAL_8.25x10.875.pdf

4/29/14

5:23 PM

Is Your Team Focusing on the Right Things?

Make sure employees see your message clearly. Effective communication, consistent messaging, and measured results are in sight with Contact. We share your vision for increased awareness.

Visit us at www.contactinc.com to learn more!

LPM 0714-A.indd 26

7/22/14 10:17 AM

INTERVIEW

FROM STORE DETECTIVE TO RESEARCH SCIENTIST A CONVERSATION WITH READ HAYES OF THE LPRC By James Lee, LPC, Executive Editor

LPM 0714-A.indd 27

7/22/14 10:17 AM

INTERVIEW EDITOR’S NOTE: Read Hayes, Ph.D., CPP, is the director of the Loss Prevention Research Council (LPRC) and coordinator of the Loss Prevention Research Team at the University of Florida in Gainesville. Hayes started his LP career with Robinsons of Florida before joining J. Byron’s, which later became Ross Stores. He left his LP role to start a training and consulting firm called Loss Prevention Specialists before obtaining his doctorate degree and moving into academic research full time. Hayes holds an undergraduate degree in criminology from the University of Florida and a doctorate in criminology from the University of Leicester in the United Kingdom. He is an ongoing contributor to LP Magazine writing the Evidence-Based LP column. EDITOR: You have been a longtime supporter and editorial contributor to the magazine, which we appreciate. Today, we want to flip the coin and have everyone get to know more about Read Hayes. Let’s start by telling us how you got started in loss prevention. HAYES: As a freshman in college I needed a part-time job. I

was interested in law enforcement, maybe becoming a game warden. There was an ad pinned to a bulletin board at the college for a store detective at a whopping $2.85 an hour with Robinsons of Florida; at that time part of Associated Dry Goods Corporation. My first apprehension I watched three subjects, two males and a female, concealing apparel. The apprehension was wild. My favorite shirt was torn off my back. It ended up involving over ten police officers. I had never had more fun in my life, so I was hooked. EDITOR: Where did you go from there? HAYES: I was also a sworn deputy sheriff briefly, working

undercover for nine months in a high school that had a crystal meth problem. When I graduated college, I did another two-year undercover stint in a drug taskforce. I then became a district LP manager for J. Byron’s. At one point I went off to army training and ultimately did ten years as a reserve U.S. Army infantry officer. When I returned from my initial army training, my district was being reopened as Ross Stores. I did that for several more years, but I really wanted to do LP research and consulting, so I started a company called Loss Prevention Specialists. There were several major retailers who purchased

and implemented the training since it was very interactive and based on real-world scenarios. EDITOR: You have always been driven by two things—your own personal education and research in the industry. Tell us how those came together for you. HAYES: When I was young, whenever we’d drive around with

my physician father, he would listen to these horrifically boring, sometimes grotesque professional-improvement tapes about various diseases or medical techniques. I didn’t go into medicine as a third-generation physician probably because I was too squeamish. But I understood the purpose for the research, clinical trials, and so forth. I knew research helped guide what they were doing, how they were doing it, and why they were doing it. That was so different than what was going on in loss prevention. In LP we were making the best decisions we could, but it wasn’t based on evidence or science, it was largely based on intuition and what others were doing. That led me to think about what we were doing and why, and how it really needed to be much more science and research-based like medicine. Billions in theft, and daily life-safety issues demanded it. We needed to understand what we were doing based on rigorous studies and trials to build a better industry. That became my passion. EDITOR: Successful people often have those who have offered a helping hand over the years. Who are some of those who have been helpful to getting to where you are today? HAYES: Mr. David Whitney, my first mentor in loss prevention,

always encouraged me to follow my passion. He would tell me, “This DLPM job ultimately isn’t you. You’re stuck in the mud. You’ve got to get out of here and make a difference. And I’ll support you.” He was the first guy to do that. UF’s Dr. [Richard] Hollinger and his counterpart in the U.K., Prof. [Joshua] Bamfield, really helped me pursue my education, which was a tremendous commitment. Also, Dr. Bart Weiss at the University of Florida helped me and Dick Hollinger construct the first National Retail Security Survey. He helped guide my doctoral research as part of my committee, and he’s one of the most dynamic people I’ve ever met. They saw that I was driven by this need to do research, and worked with me to balance education, work, and family. They all

In LP we were making the best decisions we could, but it wasn’t based on evidence or science, it was largely based on intuition and what others were doing. That led me to think about what we were doing and why, and how it really needed to be much more science and research-based like medicine. Billions in theft, and daily life-safety issues demanded it. We needed to understand what we were doing based on rigorous studies and trials to build a better industry. That became my passion. 28

LPM 0714-A.indd 28

JULY - AUGUST 2014

LPPORTAL.COM

7/22/14 10:17 AM

INTERVIEW

King Rogers asked me to come up with the one thing that needed to be done to learn more so he and his team could improve. I suggested we talk to the “target” audience; in other words, the offenders he’s trying to convince not to steal from Target stores. King says, “I’m going to hook you up with my guys in the Orlando district,” which turned out to be local district LP leader Marvin Ellison. “I want you to plot and scheme. Whatever you come up with, I’m going to order the team to make it happen.” accommodated and encouraged me so that I could get a quality education and still take care of my family. EDITOR: What was your job at that particular point? HAYES: I was consulting and doing small research projects. Being

in the reserves, I was also paid by the U.S. Army for my service. Marshall’s funded the research for my thesis, which I ended up getting published in peer-reviewed journal articles. King Rogers at Target hired me to do a couple of paid research projects and kept encouraging me, which also helped. EDITOR: After you obtained your doctorate degree, tell us when the light went on leading to the founding of the LPRC [Loss Prevention Research Council]. HAYES: I did a survey with Dick Hollinger for the International

Council of Shopping Centers, or ICSC, with the support of Dr. John Konarski. Once we got the questionnaire together, Dick and I literally built a mailing list from a book that listed all of the shopping centers in America. We had their fax numbers and planned to fax the questionnaire. At the last minute, Dr. Konarski called and said that the ICSC lawyers advised against the survey, believing there was too much risk in putting out benchmarking numbers that they could be sued over. So, Dick and I huddled in Gainesville. He’s looking at me, and I’m looking at him, and we just decided to go for it. The research was so valuable, and in our judgment would not harm, but rather help mall operators improve security. Just picture two guys faxing out hundreds of these questionnaires from two different rooms in a race against time before the mall executives realized ICSC was no longer part of the project. In the meantime, ICSC gets the word that these questionnaires are being distributed, and puts the word out not to complete them. We still received two or three hundred completed questionnaires back before they could get the word out. There’s a quick glimpse into the “glamorous” side of research. EDITOR: I understand that King Rogers was instrumental in helping form the LPRC. HAYES: I saw King Rogers at a conference, where he told me that

he had gotten my book and asked me to come to Minneapolis to meet with him. When I arrived, he hands me the book, and it has scribbling and highlights all over it. Kings says, “One of my colleagues read your book, and has completely shredded it, saying

that this isn’t a book that he would he ever use.” He’s staring at me with this stern look on his face, and I’m thinking he’s about to squash the whole thing. He tosses the book on his table and says, “I want you to know what I’m going to do about this. I’m going to buy 800 copies for my team. We’re having our LP team meeting in Phoenix. I’m flying you in, and I want you to spend time with me and my top eight guys brainstorming. After, I would like you to go in front of the overall group, and put together something interesting. Then I want to have a book signing.” He then asked me to come up with the one thing that needed to be done to learn more so he and his team could improve. I suggested we talk to the “target” audience; in other words, the offenders he’s trying to convince not to steal from Target stores. King says, “I’m going to hook you up with my guys in the Orlando district,” which turned out to be local district LP leader Marvin Ellison. “I want you to plot and scheme. Whatever you come up with, I’m going to order the team to make it happen.” All that led to a research findings presentation at the 2000 NRF LP conference in a general session. That’s when King challenged the industry. He tells the audience, “We’ve just been shooting our guns into the dark here. We need an entity to bring it together collectively, with a real scientist, and to start using better analytics.” So, the LPRC was really his idea, not mine. EDITOR: That started the LPRC, but I also know that Bill Titus played an important role in building the organization. HAYES: In those first years the LPRC was holding its own, but it

was really kick-started when Bill, who was a founding member with OfficeMax, got more deeply involved. In 2007 Bill came to me and said, “Look, you know Kmart’s a member, and Sears is now one. You know I want this thing to work. The industry needs a dedicated LP research team. Here’s the deal…” Bill was as good as his word. He’s creative, he’s innovative, he drives the hell out of profits, and he makes things happen. He flew his team to Gainesville three times, and we white-boarded ideas to clarify where we wanted to go, and how to get there. Bill helped provide vision and supervision, and made sure things were driving forward. He told me, “You better get your act together because it’s going to happen. It has traction, and it’s going to go.” The end result is that over the last seven years that growth has been rapid and expansive.

LP MAGAZINE | JULY - AUGUST 2014

LPM 0714-A.indd 29

7/22/14 10:17 AM

INTERVIEW

Our two missions are informed engagement and actionable output. Think about having monthly conference calls with colleagues, brainstorming, and telling each other what they’re doing. Now we have one or more scientists on the phone asking, “What do you want to know, and how would you use it?” We can then go and conduct surveys, focus groups, interview offenders, implement experiments, do statistical modeling; whatever is called for to give them something short and actionable—a one-page document with more detail if they want it. EDITOR: Before I forget it, you mentioned your book. Tell us the name and where to get it. HAYES: The latest book is titled Retail Security and Loss

Prevention, second edition, and it’s available through Barnes & Noble, Amazon, and other sources. EDITOR: What’s the mission of LPRC today, and how is it organized? HAYES: We now have approximately forty retail chains involved,

and we want to help them move to more of an evidence-based model. We strive to bring them together and collaborate with us, using science to provide actionable results. I think the mechanisms for that are our various working groups or action teams. We call it “informed engagement.” So, our two missions are informed engagement and actionable output. Think about having monthly conference calls with colleagues, brainstorming, and telling each other what they’re doing, which is great. Now we have one or more of us scientists on the phone asking, “What do you want to know, and how would you use it?” We can then go and conduct surveys, focus groups, interview offenders, implement experiments, do statistical modeling; whatever is called for to give them something short and actionable—a one-page document with more detail if they want it.

some very specific offender interviews to help learn how to get better intelligence. The product protection working group is developing and testing better protective packaging, fixtures, and other merchandise-display solutions. The action teams are vertically aligned for groups with common issues and interests. For example, the drug action team includes Rite Aid, Walgreens, CVS, Kroger, Publix, BJ’s, Walmart, Meijer, Target, Wegman’s, Kmart, and others that manage food-and-drug issues. They may discuss pharmacy robbery, food protection, and other issues they want us to study. There are several other action teams, including department stores, auto parts, and so forth, looking at the shared issues that they face. EDITOR: Give us an example of one of your projects or research initiatives. HAYES: As I mentioned, my dad is a doctor. Let’s say you

walk into his office and your chief complaint is headaches. He’s going to take your history, do an examination, and follow his diagnostic protocol. He then says, “I think you’ve got this problem, and this is probably why.” He’s followed his diagnostic process, which is evidence-based. There’s some gut, it’s still a lot of heart, but basically it’s evidence-based. He’ll then go through his options based on the available research evidence to determine the best course of action. That way he can make scientifically-informed decisions. In loss prevention we don’t EDITOR: Give us a little more background on some of your quite have that ability yet. There’s nothing even remotely like working groups and action teams. that—no rigorous, diagnostic, and treatment option process. HAYES: The video solution working group involves anything video That’s what our retailer members want. imagery related. We have members who employ auto plate look up, In many ways our projects and research should help us build facial recognition, and similar technology. We’re doing all kinds of that process. We conduct randomized trials, study trends and the things with analytics both in the interior and exterior of the building. available research literature, issue white papers, and take other The data analytics working group is all about data modeling steps. We’ve talked to customers to determine how LP actions and understanding how to make the data work for us. While many or inactions affect the shopper and his or her perspective of the retailers are now performing their own predictive models, we can shopping experience. We pull all of the information together and vet them and help enhance the process. say, “Here’s what we know, and here are some best practices based We have a supply chain protection working group. Every NRF Loss Prevention on studies.” Conference and Expo 2014 retailer has a supply chain, and that’s a very active, productive We’re still collectively losing billions a yearFLas working group. Greater Fort Lauderdale/Broward County Convention Center,ofFt.dollars Lauderdale, an industry, and while some individual companies are making We also have an ORC working group. We’re doingJune an industry 11 - 13, 2014 — Visit us at booth 613 survey tied in with Dick Hollinger, and then we’re going to do continued on page 32

LPM 0714-A.indd 30

JULY - AUGUST 2014

LPPORTAL.COM

7/22/14 10:17 AM

Get the most out of your video

Record it... analyze it... manage it! Chances are, your business has systems in place for many different things including POS, marketing, human resources, security, marketing, weather monitoring.

ClickIt

offers a complete line of NVR, HVR, DVR and Embedded video solutions that collect and manage your data in the most demanding environments. Our Analytics at the Edge releases untapped potential of your video data to deliver value to all levels of your organization. ClickIt’s Central Management provides a unique opportunity to truly manage your video systems by monitoring the health and well being of your video assets right down to the camera level. And, our Smart360 now provides H.264 support making 360 video an excellent alternative.

Integrating video data with business systems. For more information regarding our complete line of Digital Video Solutions give us a call at 516-827-6326 or email us at info@clickitinc.com

LPM 0714-A.indd 31

7/22/14 10:17 AM

Feature 2 INTERVIEW continued from page 30

progress, overall, not so much. That’s why the LPRC and the UF team were started by retailers. We can go in and start to narrow down the issues by listening to retail experts and other employees, going into their stores and DCs, innovating with them, and moving things around to determine how we can make improvements. We then do experiments to validate the assumptions so we can tell retailers, “Here’s what we found, here’s what the ROI seems to be, and here’s what the shoppers say.” Then if somebody else starts breaking down your case, like a buyer, your operators, or whomever, you’re covered because you have all that independent information, which is based on rigorous evidence.

recruiting and retention of members, as well as our annual Impact conference—making sure that the content and process remains highly interactive and impactful. Then there’s Mike Lamb, senior director at Walmart, who oversees the working groups and action teams—making sure that they’re productive and meet our members’ needs. EDITOR: You mentioned your annual conference. Who can attend that and what type of agendas do you typically have? HAYES: Any member of the LPRC gets two free slots to the

conference as part of their membership. They can also earn further free spots if a member serves on the board of advisors or leads a working group. Non-members may participate as well. There’s a

In many ways our projects and research should help us build an evidence-based diagnostic process. We conduct randomized trials, study trends and the available research literature, issue white papers, and take other steps. We’ve talked to customers to determine how LP actions or inactions affect the shopper and his or her perspective of the shopping experience. We pull all of the information together and say, “Here’s what we know, and here are some best practices based on studies.” EDITOR: Can anyone go online to read these reports? Where would they have access to do that? HAYES: We have eight or ten white papers that are currently

available to the public at LPresearch.org. There are many more reports and papers available to our member companies, who have access first. But eventually we want everything out there in the public domain. EDITOR: How many company members do you have today? HAYES: I think right now the number is thirty-eight retailers

and about fifty members who are either solution providers or product manufacturers. EDITOR: Is there an operating board or an advisory board that helps decide the direction of the LPRC? HAYES: Yes, we have a very active board of advisors (BOA) with

sixteen slots right now. The BOA just voted to implement a more formal structure. The new chair is John Voytilla, the VP of global loss prevention and safety at Office Depot/OfficeMax. There are also four vice-chairs, who serve as an executive committee. The executive committee includes Brian Bazer, VP at Dress Barn, who focuses on administration and operations—making sure that we’re a viable, efficient entity. Dennis Wamsley from Publix is the vice-chair for finance, providing guidance and financial advice so we can execute needed research. We have Chris Gillen, VP at Toys and Babies‘R’Us, who looks at SmartGrowth, which is the

LPM 0714-A.indd 32

JULY - AUGUST 2014

fee for non-members to cover materials, food, and things like that. The conference typically looks strategically at where retail is going, emerging technologies, and current events like cyber-attacks and what that means for retailers. We’ll often have a speaker on overall crime in the U.S. or another topic of interest to the industry. We generally have multiple breakout sessions, where we try to make those sessions as interactive as possible. The breakouts involve the working groups and action teams. They’ll go through what they’ve learned through the past year’s research, and then brainstorm and plan the next year’s research objectives. We’ll come together again for presentations or video tours of some of the innovations going on in our StoreLabs. Tyco has pledged $50,000 a year for the next three years to help fund a state-of-the-art Innovation Lab located in the University of Florida’s new and growing Innovation Square, adjacent to the sprawling 2,000-acre campus. We may brainstorm in that facility and then go around to multiple local stores of all types used for innovation efforts. EDITOR: Tell us more about what you refer to as StoreLabs. HAYES: We have about twenty-four retailers, some that have

more than one store, who allow us to come into their stores to conduct research with different technologies or multiple continued on page 34 |

LPPORTAL.COM

7/22/14 10:17 AM

LPM 0714-A.indd 33

7/22/14 10:17 AM

INTERVIEW continued from page 32

countermeasures to see how they impact loss, sales, and the shopping experience. We also work in DCs and in parking lots. We have all kinds of interesting things going on in the various StoreLabs. The retailers who participate in the StoreLab program often bring in their LP team to see first-hand what we’re doing and how it impacts their stores. EDITOR: Who are some of the retailers involved with your StoreLab program? HAYES: Some of the most active include Walmart, Big Lots,

Lowe’s, Home Depot, CVS, T-Mobile, AutoZone, to name a few. We have about thirty stores in the Gainesville area with about twenty-four fairly active. What we do in Gainesville is initial alpha testing. We need to see how to do things, and how those things affect shoppers, employees, and, of course, offenders before going out to higher risk or busier locations. Then we take those findings and go to higher crime areas like Miami, Jacksonville, Atlanta, Chicago, or DC. To give you an example, we start in a Gainesville Home Depot store, then have a Home Depot StoreLab in Los Angeles where you have to pass through a security guard just to park there due to the crime challenges. That gives us a different look at how things work or don’t work in different environments.

EDITOR: What are you most proud of that has come out of the LPRC? HAYES: I think the idea that now, very respected leaders in our

industry—senior decision makers—are buying into research in loss prevention and starting to adopt some of what we’re doing would be the first answer. The second is going to industry conferences and hearing new people saying, “Wow, this is the way to go. I believe in LPRC or evidence-based practice, and I’m going to get involved.” EDITOR: What are the next steps for the LPRC? HAYES: I would like us to get an additional ten or more retail

chains involved so we can grow and accomplish more. That also would give us a more diverse work environment. We currently have two LPRC full-time scientists under me as well as UF faculty and grad students, but I would like us to have four LPRC scientists to allow full-time focus. I think that will take some time. What’s being done with the LP Foundation and the content of the LPQ and LPC certifications is great, but I would like to see them become even more saturated with evidence-based content than they are now. Gene Smith and everyone at the Foundation are great. They’re always asking me, “What are you doing? Is there any way that we can get you more involved?” I want to make sure they’re incorporating our research findings

10TH ANNUAL LPRC IMPACT CONFERENCE The next gathering of the LPRC is scheduled for October 13 – 15, 2014, on the campus of the University of Florida in Gainesville. The impact conference is focused on communicating the results of the past year’s research activities as well as looking at those retail issues that warrant adding to the list of research in the coming year. The conference features presentations by both scientists and retailers who participated in the research. Top left, John Voytilla addressed attendees at the 2012 conference. Voytilla, chief security officer at Office Depot/OfficeMax, is the current chair of the LPRC board of advisors. A large portion of the conference involves group participation on specific topics of interest. This interactive aspect of the conference both stimulates participation by all attendees as well as facilitates the direction for new research by the LPRC. Bottom left, John Doggett, LPC, director of LP merchandising/ vendor shrink solutions and analytics of Lowe’s, presents the results of a smaller group discussion on RFID to the entire conference attendees. For more information about attending the upcoming conference or getting more involved with the LPRC, visit LPresearch.org.

LPM 0714-A.indd 34

JULY - AUGUST 2014

LPPORTAL.COM

7/22/14 10:17 AM

INTERVIEW

We’re still collectively losing billions of dollars a year as an industry, and while some individual companies are making progress, overall, not so much. That’s why the LPRC and the UF team were started by retailers. We can go in and start to narrow down the issues by listening to retail experts and other employees, going into their stores and DCs, innovating with them, and moving things around to determine how we can make improvements. into their content. That would be the next step. Medical school content is evidence-based, and so should LP training content. Also, I feel that we haven’t arrived until we are sitting and talking to the CEOs, CFOs, and COOs at the NRF Big Show, for example. We will have arrived when the CEOs are expecting that their key LP decision makers are adopting evidence-based content and that level of expertise is required. EDITOR: You don’t think we are there yet? HAYES: We are certainly making strides and some retailers are

further along than others. Recently I was at a corporate office with their esteemed SVP of LP and his team. The COO comes into the room, as part of their amazing strategy session. The COO

starts off saying, “Last year we did great. Here are the numbers. This year we’re on track to do this well. But with all the cost pressures, here are the three things we’ve got to do to maintain where we are—not to keep growing, but just to maintain.” He then says, “Look, here’s what loss prevention needs to do to help me meet this objective, to meet this one…” and so forth. Here we have a C-level executive saying in a very intricate way exactly how strategic LP is. It’s not a peripheral issue. He is not just checking a box. He’s saying we’re going to have these key objectives, and this is how LP can structure and work the process to support these things that are absolutely paramount to what we’re trying to accomplish. It was incredible because that’s where we’re all trying to go. LP more than matters, it is critical to successful retailing.

LP MAGAZINE | JULY - AUGUST 2014

LPM 0714-A.indd 35

7/22/14 10:17 AM

DIGITAL DIALOGUE

Staying Informed: Is It Really That Important? I

By Jacque Brittain, LPC Brittain is editorial director, digital, for LP Magazine. Formerly a director of learning design and certification, Brittain managed the development of the LPC and LPQ certification programs in collaboration with the Loss Prevention Foundation. Prior to that he was vice president of operations for the industry’s largest executive search and consulting firm. In his thirty-plus years in the LP industry, he has helped build and enhance many learning initiatives and provided career counseling for thousands of industry professionals. Brittain can be reached at jacb@lpportal.com or by phone at 704-246-3143.

f it wasn’t your company, would it matter to you which retailers were breached over the last six months, or how it has impacted their business? Do the latest statistics or industry trends really change the way you approach your job? Does it really matter whether or not you were able to attend an industry conference this year? How does a cargo theft or robbery halfway across the country influence what happens in your back yard? How many times do we need to hear that credit card fraud is a problem in the stores? How often do we need to read about the latest technological gadget or industry training seminar? Are you as informed as you should be? Does it matter, and why should it matter to you? We all know what the answers are supposed to be. But is that a true reflection of how we really feel? If we’re honest with ourselves, the answers might not play out the same way. We might think that it doesn’t matter whether or not we could have learned or gained anything by attending an industry conference because we didn’t have the opportunity to attend. We may rationalize that industry problems are only important when they occur within our own companies. We can believe that some problems are going to exist no matter what we do, and we may just be spinning our wheels. We can minimize the importance of progress or squander the opportunity to learn for any number of self-serving reasons. In some way, shape, or form, we’re all guilty of this way of thinking at some point. That’s not necessarily an indictment of our character or a reflection on our work ethic. It’s just that none of us are that good. None of us are that informed. We get tired. We get busy. We get to a point where we suffer from information overload and just can’t seem to accept one more piece of information. We disengage and get involved in some other aspect of our lives. Some of us may have a greater desire or make a bigger effort. Some of us may have a higher capacity for absorbing the information. But we simply can’t, don’t, or won’t be that informed. We may make the effort, but no matter what we’re told or what is preached to us, it’s just not in our nature or capability to know or learn everything that we should.

important to learn. We look at what’s most valuable to us, we consider our options, and we make decisions. But fortunately— or unfortunately, depending on how you look at it—there’s a tremendous amount of information that we must sort through, decipher, and absorb. Therefore, we seek out tools to help us manage this plethora of information and decide what is most valuable. And that’s where social media gives us a boost. That’s why digital dialogue is so critical. Social media is an ever-evolving collection of online tools, platforms, and applications that enable all of us to interact with one another and share information. By using web-based and

A Tool for Every Job

mobile technologies to turn communication into interactive dialogue, it creates an effective channel for individuals and groups of people to connect, interact, create, and share. The question then becomes, are you using the right tools? Are you taking full advantage of the tools that are available to you? If you couldn’t attend a conference that interested you, did you visit the conference website? Often, many of the presentations are

So, what do we do? It isn’t a revelation for any of us to hear that information is important. Of course we understand the value of staying informed, and how these events and this information will directly or indirectly impact all of us. We know that information is power in many different ways. In response, what each of us does is set priorities. We determine what is most

LPM 0714-A.indd 36

JULY - AUGUST 2014

Leaders pride themselves on making informed decisions. This is an opportunity to make an informed decision about information. What choice will you make? If you have a strong argument for not remaining informed, we’d love to hear it. In fact, we’d be happy to discuss it in our digital media, discussion groups, or our next column in the print magazine. The stage is yours.

LPPORTAL.COM

7/22/14 10:17 AM

made available following the presentations, which was the case for the primary conferences held thus far this year. LP Magazine also shared newsletters and videos as well as content on the app and home page to help keep you informed of these events. There were other media outlets as well. Have you signed up for the LP Magazine app? Do you receive our weekly newsletters? Are you a member of the “Powered by LP Magazine” group on LinkedIn? Are you a member of any LinkedIn groups? There are more than fifty groups dedicated to loss prevention alone that can provide you with regular postings and emails designed to keep you informed on critical topics. What about Facebook or Twitter? These and others can provide fast, effective, and focused information as well as network building. Now let’s take a moment to pause for the excuses, since this is where they start to flow. ■ I don’t have time. Really? These tools are designed to gather important and relevant information and present that content to you in a way that is convenient, easy, organized, and swift. Are you really that busy that you don’t have time to read a headline and make a decision as to whether an article might hold value? Are those two seconds really that critical to your everyday work schedule? Sorry. You do have to open it up to take a look. We’ll stretch it to five seconds. ■ I don’t need or want another app on my phone. Would that be because “Angry Birds” or “Candy Crush” is that much more valuable to your professional growth? If there are really so many apps on your phone that it’s difficult to manage, maybe there’s another issue. There’s a reason that it’s called a smartphone. Think about it. ■ It’s just another email that I have to manage. If the topic of an email doesn’t hold interest or value to you, just hit “delete.” We all do it every day. But the content we’re referencing is professionally-based, and focused on subjects directly related to what you do for a living. What if the topic does hold interest or value? What if it makes you better or makes your life easier? Isn’t it much wiser to allow yourself the option? ■ I’m just not that interested. At least it’s an honest answer. But keep in mind the power of information. Access to information is half the battle. This approach is not information management— it’s information avoidance; and there are potential consequences. Leaders pride themselves on making informed decisions. This is an opportunity to make an informed decision about information. What choice will you make? If you have a strong argument for not remaining informed, we’d love to hear it. In fact, we’d be happy to discuss it in our digital media, discussion groups, or our next column in the print magazine. The stage is yours.

Diversity Remains the Norm

Once again our news stories have been diverse and worldwide. For example, six suspects were charged with operating an illegal prescription drug ring out of a Bronx grocery store. In Sydney, Australia, a five-day operation targeting shoplifters resulted in the arrest of 110 people. A shoplifter was stripped naked and beaten in Ghana. A U.S. corporation claimed that a former software engineer stole the company’s technology and used it to help a rival company in China. Over four hundred counterfeit items were seized from a California sporting goods store. A fugitive fraudster involved in a multi-million-pound scam was arrested in the United

Kingdom. Over $1 million worth of merchandise that was stolen as part of a cargo-theft operation was recovered in Toronto. To round out our international field, we also had a runway model who has appeared in fashion shows for an Argentine clothing designer charged with shoplifting junk food and three boxes of Pop-Tarts in a Manhattan court.

Kudos to the Conferences

Especially considering the demands of the audience, our conference hosts in 2014 worked hard to offer content that was current, relevant, and important to the attendees. Our presenters found creative ways to introduce the subjects and engage the audience, and the attendees served as attentive and active participants in the sessions. Many of the presenters, participants,

Social media is an ever-evolving collection of online tools, platforms, and applications that enable all of us to interact with one another and share information. By using web-based and mobile technologies to turn communication into interactive dialogue, it creates an effective channel for individuals and groups of people to connect, interact, create, and share. and solution providers have graciously agreed to provide additional content through both our digital channels and print magazine, which we look forward to bringing to you over the coming months.

Dog Days of Summer

Finally, we have a compelling story that involved a dumb crook…and a smart dog. Following a report that the man had shoplifted a burrito from an area store, an officer approached the suspect and attempted to place him into custody. A fight ensued, and the officer deployed his K-9 partner to assist with the arrest. During the fight, the suspect reached into his pocket and pulled out a handgun. At this point, the K-9 bit onto the arm of the suspect so that he couldn’t fire the weapon. When the officer saw the firearm he then drew his duty weapon and fired, striking the suspect, who died at the scene. What drives a man to risk that much over a burrito? It’s another striking reminder that there is no such thing as a “routine” shoplifter apprehension, and no limits to the depths of poor decisions. Perhaps a more difficult question is where would we be without the support and loyalty of our four-legged companions on the police force? Let’s hope that the officer stopped for T-bones on the way back to the station.

LP MAGAZINE | JULY - AUGUST 2014

LPM 0714-A.indd 37

7/22/14 10:17 AM

PARTNERING WITH RETAILERS

By Dave DiSilva, Manager of Global Asset Protection

Where We’ve Been and Where We’re Headed This column is focused on reviewing some of what we

PROACT Cases in the News

Where PROACT Has Been

defrauding eBay customers and was sentenced to one year in prison with thirteen years of supervised probation and ordered to pay $162,000 in restitution. ■ The Polk County (FL) Sheriff’s Office conducted an ORC training week that included a two-day blitz that resulted in 41 people, 32 of whom had criminal records, arrested on ORC-related charges.

have done over the last few months and where we are heading next quarter. The goal is to keep you up-to-date on what is new with our retail outreach and share some success stories. We encourage you to join our LinkedIn page “eBay Partners with Loss Prevention Professionals” to stay informed on the latest eBay PROACT information.

■ In April 2014, David Grindle of Boise, ID, plead guilty to

We are constantly seeking opportunities to outreach with our retail partners. One of the ways we do that is through getting out of the office. Here are some recent examples. ■ Presented at the U.S. Secret Service fraud seminar in their Brooklyn New York Office. ■ Participated in the Polk County organized retail crime training. ■ Attended the London Retail Fraud Show. ■ Attended the Dublin Ireland Retail Fraud Seminar. ■ Hosted the National Retail Federation Fusion Center with Macy’s. ■ Presented at the Atlanta Cyber Crime Summit hosted by the International Association of Financial Crimes Investigators. ■ Presented at the Utah Organized Retail Crime Association (UTORCA). ■ Held retailer webinars on conducting online investigations. ■ Participated in the Gemological Institute of America (GIA) training on how stones are graded, the identification of precious metals, and watches identification and tracking methods

Where PROACT Will Be

■ The leader of an ORC theft ring in York, PA, plead no contest in

■ We will present at the Retail Council of Canada LP conference

in Toronto, ON, September 10 – 11, 2014. ■ We will present at the Fifth Annual Coalition of Law Enforcement Conference (CLEAR) in San Diego, CA, on Monday October 13, 2014. ■ We will participate in the Loss Prevention Research Council (LPRC) 10th Annual Impact Conference in Gainesville, FL, October 13 –15, 2014.

PROACT Changes

We continue to enhance the PROACT program and look for efficiency gains. We are excited to announce for our hundreds of PROACT members, all request submissions will transition from email to our eRequest system through an eBay portal effective August 18. The process streamlines how we receive and respond to requests and ensures requests are channeled to the appropriate investigator. 38

LPM 0714-B.indd 38

eBay representatives in the Fusion Center at the 2014 NRF LP conference in Fort Lauderdale, Florida, in June. From left to right are Zuzana Crawford, Hawken Averett, Dave DiSilva, Paul Jones, and Christian Hardman.

JULY - AUGUST 2014

June to multiple charges and was sentenced to state prison. Police said the man instructed his 137 co-conspirators, who were mostly drug users, on what items to steal from stores in parts of Pennsylvania and Maryland. ■ Three members of a suburban Chicago, IL, family were arrested and charged with interstate transportation of stolen property following a purported five-day shopping odyssey that started in Oklahoma, continued at malls in Texas, and wound through Louisiana before returning to Northbrook. The defendants, together with a cooperating individual who acted as their fence, and others sold merchandise over the past decade that totaled $4.2 million.

How to Reach Us

You may reach us at PROACT@ebay.com. Enjoy the rest of your summer, and perhaps we will see you at one of the upcoming events.

LPPORTAL.COM

7/22/14 10:24 AM

Feature 3 FEATURE

THE CHALLENGES IN DEALING WITH

DATA BREACHES A CYBERSECURITY PANEL DISCUSSION

LPM 0714-B.indd 39

7/22/14 10:24 AM

DEALING WITH DATA BREACHES

he 2014 Retail Industry Leaders Association (RILA) Asset Protection Conference featured a panel discussion of the evolving cybersecurity threat to retailers. (Left to right) Ryan Knisley, a security expert with Accenture, moderated the panel that included Lou Stephens, special agent in charge, United States Secret Service; Shawn Henry, president of CrowdStrike Services; and Rich Noguera, head of information security, Gap Inc. Following are excerpts from the discussion courtesy of RILA.

KNISLEY: Rich, as an IT security leader for a retail company,

how do you work with asset protection professionals to protect your company?

your organization and your network resilient and robust to protect against them. KNISLEY: Lou, we continue hearing about companies being

NOGUERA: First and foremost, it’s important for me to be an

information resource helping my LP peers understand what my team thinks is really happening in the digital space. As we move closer to closing the gap between brick-and-mortar physical space and digital space, it’s going to be absolutely critical that IT and LP partner more closely to understand what the threats are, and how we react to those threats. Beyond that, it’s very important to partner with law enforcement. We need to get the right actionable information to our law enforcement peers. KNISLEY: Shawn, what is “actionable intelligence” that Rich mentioned, and how does it help retailers be more secure? HENRY: Actionable intelligence is really just information that you

can take some overt steps to respond to. Whether we’re talking about physical security or information security, it’s not enough to just react to what happened. If you’re reactive, then something bad has already occurred. We want to be proactive, we want to make sure that we understand in advance what’s coming around the corner, and we want to know how to prepare for it. One part of actionable intelligence is understanding who the adversaries are. Who is likely to target you? What is it they’re looking for? What are the techniques or the tactics that they’re going to be employing against you? If you understand these things in advance, if you understand who your adversaries are and how they think, you are in a much better position to make

LPM 0714-B.indd 40

JULY - AUGUST 2014

breached and critical data being lost, and often times the Secret Service is tasked with working with these companies to investigate a breach. Can you shed some light on law enforcement’s role in working with companies, and what a company’s expectations of law enforcement should be after a breach? STEPHENS: First and foremost, when there’s a data breach, the

company has been victimized, so they should expect to be treated by law enforcement with the support and discretion that law enforcement would provide any victim. That discretion is very important. In our view, a breached network is like a crime scene. There might not be a broken window or a broken door, but there are digital equivalents on the network where the hackers broke in. We want to find those clues, understand them, and try to trace them backwards to where they came from. Furthermore, we want to know what they did while they were in the network. Are they still there? How long were they there? What type of malware and hack tools did they deploy? This information is really key evidence that, along with a company’s server logs, help us to understand exactly what happened, and how they did it. These cases are very technical. They are very complex. So the outcome is much better when law enforcement works hand-in-hand with companies very collaboratively and transparently. One of the things that you can expect is for law enforcement to want to work with you face-to-face to gather evidence. We’ll want to send over our investigators to work with |

LPPORTAL.COM

7/22/14 10:24 AM

DEALING WITH DATA BREACHES your IT professionals or any third-party vendors that you might have hired to help you deal with this. KNISLEY: Given your experience working with retail, what sorts of changes could retailers make to be better prepared? STEPHENS: It’s important for people in corporate security to get to

know their law enforcement counterparts, and vice-versa, before there is an event. We need each other’s phone numbers before we need them. You don’t want to be looking for them in the middle of a crisis. Quite frankly, the last thing that law enforcement wants to do is meet you for the first time while we’re handing you a grand jury subpoena because we think you’ve been breached. In my experience trust comes through relationships. But it’s a two-way street. It’s really incumbent upon law enforcement to be proactive in getting to know you as well as you getting to know law enforcement. HENRY: I couldn’t have said it better. And I think one of the key

pieces is understanding who the actors are. There are a variety of actors looking to access your data for a lot of different reasons. In the retail space they are primarily thieves looking for personally identifiable information that they can exploit and turn into cash. But there are other groups as well. There are nations that are targeting organizations for their research-and-development assets, intellectual property, and corporate strategies. They are looking at companies that are moving overseas and partnering with foreign nations, looking for that very critical information. As it relates to organized crime groups that are targeting the retail industry, it’s very important to identify them, and then take law enforcement actions to mitigate the threat. These hackers will continue indefinitely for years until they’re caught because they’re making a lot of money. The risk of getting caught is relatively small, comparatively speaking. And until you are

STEPHENS: A lot of these actors are a world away, safe from the

prying eyes of law enforcement. And many have virtual immunity because the countries they live in will not only refuse to work with us as law enforcement, but may actually aid them. So, one goal we have is to identify them and put them in jail. But another goal is to protect the larger industry and the larger infrastructure. We really want close collaboration with the company and with third-party vendors so we can understand what the indicators are and how exactly this stuff is deployed. That way, the industry as a whole can get an idea and an understanding about what the immediate and current threats are that are out there. Here is how they’re working. These are the techniques they use in their attacks. And now that we know, we’re trying to build up defenses as well. HENRY: I know in my experience in retail that asset protection historically has done a much better job with information sharing than our cybersecurity leaders have. Whether formal or informal, asset protection has formed groups for information sharing. Many of the LP leaders in this room know each other personally and are friends. They do a really good job of calling up their colleagues and sharing information about bad actors and their stories. Maybe it’s Lowe’s letting Home Depot know that an incident has just occurred and to be on the lookout for such-and-such individuals. I think we can learn some really good lessons from what they’re doing in the store environment and apply that to what we’re trying to do in the digital space. Because as soon as an adversary succeeds with some given attack on one organization’s network, you can rest assured they’ll be targeting others. STEPHENS: I think that you’re absolutely right. If everybody is able to better defend, everybody becomes stronger. I think there are actually lots of similarities between the physical world and the cyber world, but of course there are also differences. And one of the

“First and foremost, it’s important for me to be an information resource helping my LP peers understand what my team thinks is really happening in the digital space. As we move closer to closing the gap between brick-and-mortar physical space and digital space, it’s going to be absolutely critical that IT and LP partner more closely to understand what the threats are, and – Rich Noguera how we react to those threats.” actually able to take them off the playing field through the efforts of law enforcement, these things continue. It really is kind of a big dance and requires great collaboration between law enforcement, the retailer, and the third-party consultancy that is coming in to help secure the network. Law enforcement’s role is about collecting evidence, and then looking for the adversary; looking for the bad guy. Those folks all have to be able to work together in a very cohesive fashion in order to be successful and to have a positive outcome.

differences is the speed at which things occur. In network security, the adversaries are changing their tactics and their techniques literally on a daily basis. And to be able to stay a step ahead of that is very, very difficult. The way we normally think to share information, by phones calls, list serves, emails, personal contact— these things don’t always scale in this environment because of how broad the threats are and how broad the adversary pool is. They’re working globally from anywhere in a hundred different countries. So, there are a lot of efforts toward making people much more

LP MAGAZINE | JULY - AUGUST 2014

LPM 0714-B.indd 41

7/22/14 10:24 AM

Feature 3 DEALING WITH DATA BREACHES capable of sharing very specific threat information that will allow them to better protect their needs.

possible. So, one of our primary challenges in retail is how do we accelerate that game?

KNISLEY: Rich, in the context of these worries about the digital

KNISLEY: Shawn, you work with companies in every industry. When you’re working with retailers, what are the nuances or differences that you see compared to a high tech or energy company?

space and bad actors getting into our network from outside, how does the in-person threat in physical stores concern you? NOGUERA: Network segmentation, hardening of the devices, testing thoroughly—both in-store testing and external store testing—all this is essential. But, as always, the first line of defense is in-store associates, and the training and understanding and responsibilities necessary to protect those assets. Especially when you add in additional capabilities at POS, it becomes even more critical. So, the in-store associate is our best defense here. KNISLEY: Rich has worked for some of Silicon Valley’s biggest companies, so he has deep experience in the high-tech world. What challenges are you facing in retail that are unique to retail, those that you didn’t see elsewhere? NOGUERA: That’s a good question. When attacking a retail

network, it’s typically a smash-and-grab approach. The goal of an attacker is to get in there as quickly as possible, grab as many credit cards as possible, and get out. The methods of entry and methods of attack are the same whether it’s crime-motivated, a nation-state-type motivation, or a larger coordinated type of event. Coming from high tech, we were always at the leading edge of applying the latest and greatest technology to get as predictive as

HENRY: When we’re talking about protecting the network, I

don’t think that there really are major differences. There are some differences within the architecture and infrastructure—POS devices, for example. But the reality is that the techniques and the capabilities that retailers need to employ to prevent and detect these types of attacks are essentially the same. In IT, for years we’ve been practicing defense-in-depth. We do it in the physical world as well, of course. But in the information world, it’s about firewalls, intrusion-detection systems, two-factor authentication, and encryption. You layer your defenses so that you can be more resilient. But the reality of it is, in the IT space, the most sophisticated adversaries will get into the network one way or another. Maybe that sounds defeatist, but let me illustrate. We’ve worked with organizations that have 100,000 network endpoints. Imagine in a brick-and-mortar store trying to protect a building with 100,000 doors. Every one of those endpoints is a potential ingress into the network. They’re going to get in. While the old paradigm in information security used to be preventing an attack, the reality of it is that now we can’t do that. We have to assume that an adversary is going to be there. The new continued on page 44

Use independently

Use with accessories

strapping

loop cable sensor cable

adhesive

Introducing a new all-in-one EAS sensor with multiple applications for packaged goods and demo devices! www.intelligentlossprevention.com • 800.747.4384

LPM 0714-B.indd 42

JULY - AUGUST 2014

LPPORTAL.COM

7/22/14 10:24 AM

30-621 230X B

MAX

RITY

MS IMU ECU

16,000 LBS. OF PULL FORCE

Our bad boy is stronger than these bad boys. A Detex exclusive, the 230X MAX multi-point locking device withstands 16,000 pounds of pull force. When the bad guys try to muscle in, the super-tough 230X MAX keeps them out. Designed with extreme-duty, three-bolt construction, this device is built with a larger side bolt that goes deeper into the frame, plus solid steel connecting rods rather than less-reliable hollow rod/cable construction.

SA 02 P RL th 2 o Bo

How tough is it? The bottom bolt goes 5/8-inch deep into the floor, preventing peeling up the bottom of the door. The largest side deadbolt in the category resists crowbarring. And at the top corner, the solid steel deadbolt provides needed stability. Testing proves that a 230X MAX secured door withstands 16,000 pounds of pull force. Life safety and code compliant, the 230X MAX is both panic hardware and a maximum-strength locking device. Ask us how this powerful new hardware can take the hit for your business, or go to detex.com/go/230XMAX.

LPM 0714-B.indd 43 30-621 230X Bad Boys Ad rev.indd 1

800-729-3839 830-629-2900 www.detex.com

7/22/14 10:24 AM 5/27/14 2:59 PM

DEALING WITH DATA BREACHES continued from page 42

paradigm needs to be about minimizing the time between them gaining access and us detecting them. It’s not enough to just monitor the perimeter; to watch the parking lot and watch the loading dock. That’s not going to work in IT. You’ve got to work on hunting throughout the environment and actively looking for adversaries, looking for an indication that they’ve been there, and if you can mitigate that threat, you’re going to be successful. When I was in the Bureau, our agents would go out dozens of times per week and knock on the doors of major companies around the country, and tell them that they’ve been breached. When the FBI or Secret Service shows up at your door and says, “You’ve been breached,” in most of the cases, the organization say, “No, we

when they get in, they spend months figuring out how to do what they want to do while hiding their tracks. So, the longer they’re in, the harder it is to catch them—not easier. And so in my view we need a strong, robust defense, but we also need a strong, robust offense. Frankly, I don’t know that we’ll ever stop this. But we can make ourselves more of a hard target, so hackers are disincentivized to come after us, and they’ll go after more low-hanging fruit. KNISLEY: Shawn, building on what Lou is saying, companies are

spending billions every year to protect themselves, yet we continue to see breaches. In your opinion what can companies do pre-breach to mitigate the effects post-breach?

“In IT, for years we’ve been practicing defense-in-depth. We do it in the physical world as well, of course. But in the information world, it’s about firewalls, intrusion-detection systems, two-factor authentication, and encryption. You layer your defenses so that you can be more resilient. But the reality of it is, in the IT space, the most sophisticated adversaries will get into the network one way or another.” – Shawn Henry haven’t.” So we say, “Really? Is this all your stuff right here? Look at this database we found. It’s on a server getting ready to head over to Guangdong Province. You’re saying that’s not yours?” And then they say, “Well, yes, maybe it is.” Then they would go back, search, and ultimately they’d find out that, yes, in fact, they had been breached. And it turns out they were breached four months ago or eight months ago or two years ago. Now, if you allow an adversary in your network for four months, eight months, or two years, bad things are going to happen. In the physical world if you allow somebody into your stores for eight months undetected, being able to do whatever it is that they want to do, and walk in and out with pallets of merchandise, bad things are going to happen. If, on the other hand, you can detect them within a couple of minutes or a couple of hours, you can mitigate the threat. STEPHENS: Let me speak broadly here. We are spending billions and billions of dollars as a nation on defending and protecting our networks, yet we’re still getting breached all the time. To use a sports analogy, the best defense with zero offense isn’t going to win a game. Conversely, an offense needs a robust defense. I would like to suggest that when you do work with law enforcement, you are assisting with the offense. We don’t always get the bad guys because of the reasons we’ve discussed before, but sometimes we do. There is a strong, coordinated effort to go after these people and to get them to stop doing what they’re doing. Shawn mentioned that we’re never going to be able to have a completely invulnerable defense. They’ve got tons of time. And

LPM 0714-B.indd 44

JULY - AUGUST 2014

HENRY: This is the whole piece about being proactive. Rather than

putting the pieces of the puzzle together to figure out who did what, you need to be “left of boom,” as I’ve heard it said. I want to be there to prevent it before it occurs; I want to be hunting. I think it’s a really important term, and I use it a lot. Hunting on a network is being proactive and being engaged. Yet there are just too many people who have said, “We’ve got our defenses in place. The fence is up. The alarm system is on. We’re good.” And then they go to sleep. That is just the wrong way to do things. You don’t just find a particular server that was compromised, fix it, and go on. What’s important is understanding who was there, why were they there, how did they get there, what have they done, are they still here, what did they leave behind, and what did they take? We do all that on the front side as well. You don’t have to wait for an incident to collect that type of intelligence, and it’s absolutely critical that we’re doing that. Again, in the physical world, we have done it to prevent terrorist incidents. We have not had a significant terrorist event in this country since 9/11, not because we live in a completely secure environment. Quite the opposite. There are lots of people walking into this hotel with big suitcases, any one of which could contain a bomb or something of that nature. The reason that we haven’t had one of those serious incidents is because of law enforcement, the intelligence community, and the Department of Defense are constantly identifying bad actors that are coming in and mitigating the danger before any of us watch it on CNN. continued on page 46 |

LPPORTAL.COM

7/22/14 10:24 AM

As a member of The Loss Prevention Foundation, you join an association founded by and for loss prevention professionals. With access to an elite network of fellow industry professionals, development tools tailored specifically to our industry to help you advance your career and other great member benefits such as exclusive access to elite savings and discounts on thousands of products and services nationwide. Your membership is not only a demonstration of industry leadership; it’s a commitment to the profession and to your own professional development. Elevating the Industry, One Leader at a Time. For more information, visit losspreventionfoundation.org or call (866)433-5545

LPM 0714-B.indd 45

7/22/14 10:24 AM

Feature 3 DEALING WITH DATA BREACHES

“It’s important for people in corporate security to get to know their law enforcement counterparts, and vice-versa, before there is an event. We need each other’s phone numbers before we need them. Quite frankly, the last thing that law enforcement wants to do is meet you for the first time while we’re handing you a grand jury subpoena because – Lou Stephens we think you’ve been breached.” continued from page 44

about hardening the network and preventing further damage. But from an external perspective, it’s going to be about managing the media. Do we need to deal with the regulars who have got DCIs that were stolen? How do we communicate this to our clients, to our customers, to the general public? This is why leadership needs to be so closely involved. They’re looking at risk—operational risk, financial risk, and reputational risk. If your reputation is damaged, and it has taken you two decades or five decades or a hundred years to build, to lose it in a course of a three-week incident is not something anybody is going to be happy to see.

KNISLEY: Shawn, you’ve had the opportunity to work with companies after they’ve been compromised, which is a very traumatic time for companies. In your experience, what do you see as best practices post-breach? HENRY: During a remediation, I think the first important thing is that

the leadership of the organization gets it. I think you have to have all of the key executives as part of the response—the general counsel, the COO, the CFO. You are going to have to have the key leadership together, because it’s going to be a whole organizational response. Then you want to stop the bleeding. You want to prevent the network from being further damaged. You want to prevent the adversaries from stealing additional information. So, internally it’s

STEPHENS: Let me jump on that. Organizations that have a plan

ahead of time that is written and practiced seem to fare better. Most

InstaKey® Security Systems Helping Retailers Manage Their Key Control for Over 25 years!

WE UNDERSTAND THE CHALLENGES RETAILERS FACE WHEN IT COMES TO THEIR KEY MANAGEMENT… OR MORE COMMONLY, LACK THEREOF. Are you tired of…

• Inconvenient & Costly Locksmith Callouts? • Inopportune IC Core Swap Holdups & Delays? • Unauthorized Key Duplication?

InstaKey® provides a solution to all your keyed access needs with:

• Restricted Keys That Cannot Be Duplicated • Serialized Keys That Can Be Monitored • Simple & Cost-Effective Single Key Turn Rekeys • 24/7 Web-Accessible Software • Key Quantities Reduction • Improved Staff Accountability

TO FIND OUT MORE! 46

LPM 0714-B.indd 46

www.instakey.com JULY - AUGUST 2014

800-316-5397 |

sales@instakey.com

LPPORTAL.COM

7/22/14 10:24 AM

DEALING WITH DATA BREACHES organizations are now routinely preparing for major power outages or natural disasters. We suggest having a similar plan for a data breach. Step one is who are we going to assign and what roles will they have? And I agree, I think you’re going to want people at the highest executive level that you can get on the leadership team, to evaluate the situation on a day-to-day basis and make key decisions. But I also think you want a response team, and these would be people more like IT security professionals who would work directly in trying to find out and understand what happened in a breach and also work with third-party vendors if you choose to hire them. That response team would deliver a written plan to the leadership team and actually practice it. Do an exercise once a year. That way you’ll find out the holes that are in the plan and what needs to be changed. KNISLEY: We talked a lot about what retailers should do in preparation, pre-breach, post-breach, and some expectations in working with law enforcement. Lou, I’d like your opinion on what retailers should not expect in working with law enforcement after a breach occurs? STEPHENS: Law enforcement will not remediate your network.

You’ll have to do that yourselves with whatever help you decide to hire. That’s probably the biggest takeaway. We’re there to investigate the crime. HENRY: I will add another point. From the perspective of law

enforcement and the U.S. government’s role, they will share

intelligence to the extent that they can, but the government is not going to protect your networks. In the physical world, it’s very clear what our government does. The government’s fundamental responsibility is to protect you as citizens. If there are armies massing on the border, the U.S. government is going to be able to intervene and protect us. That’s very clear. Everybody knows what it looks like when an adversary physically poses a threat to us, and what the government’s response is going to be. But the government is not stopping the ones and zeroes from coming through the fiber. That’s not happening. The government is not scanning the ISPs and filtering traffic. That is not happening. Therefore, the first defense, the first initial response to every one of these attacks—every single one—begins with each of us sitting here—our companies, our IT specialists. And that’s why this intelligence piece, this idea of hunting on the networks; the things that we’ve all been talking about today are so critical. Why? Because this is the first time in history where the private sector has the primary responsibility for defense and protection. The government is doing some great things. With the intelligence they’ve collected, there are some things that can be shared and some actions that they can take proactively. But that’s not from a defensive perspective on your networks. You own that responsibility. You own that obligation. The data that’s being stolen is funded by your investors. It’s your clients’ information, your customers’ information, your employees’ information that they’re entrusting to you, and you are solely responsible at the outset to protecting it and making sure that it really is safe.

Satisfaction. The Yarra Honda four-story dealership in Melbourne, Australia focuses

on customer service with help from Milestone XProtect® Enterprise. Staff use the video surveillance software to identify showroom customers who need help and receptionists monitor if employees are at their desks before transferring incoming calls. Proving again Milestone can solve problems that are more than security.

Milestone XProtect® is the world’s leading IP video surveillance management software and is reliable, future proof and easy to use. It supports the widest choice in cameras and seamlessly integrates with business and security solutions such as video analytics. Which means your possibilities are unlimited and you can keep your security options open. Milestone Systems U.S. Tel: 503 350 1100 See our new products and the new ways to use XProtect at: www.milestonesys.com

LP_halfpage_Honda_landscape.indd 1

LPM 0714-B.indd 47

LP MAGAZINE | JULY - AUGUST 2014

13-06-2014 15:38:32

7/22/14 10:24 AM

ASK THE EXPERT

Data Security: Reaching Beyond Compliance EDITOR’S NOTE: Building on common ground improves comprehension and enhances professional development. One way to accomplish this is by asking the experts—those with exceptional ability and expertise to explain concepts, products, and functions in terms that can be easily understood and applied in everyday situations. Data security is a critical subject that demands the attention of every LP practitioner, and bridging the gap between LP and IT remains essential to our future success. LP Magazine recently sat down with Paul Murray, senior vice president of product management for Wontok, Inc. to help bring insight into building these relationships. Wontok’s industry expertise is bringing value-added data security services to businesses across the U.S., Europe, and APAC. What are the biggest hurdles that retailers face when building an effective communications bridge between LP and IT? Information exchange and collaboration is the key. Loss prevention and IT need to form a partnership with a common language that embraces the financial as well as the technical, especially considering how that pertains to data security. Technology alone won’t bridge the gap. Some of the biggest challenges in business are changes to the culture, and the fundamental challenge here is cultural. We can’t allow either of these departments to operate in a silo. Some changes will require IT and LP to work more closely together at a compliance level, which helps build a common language. Working together and having like goals is a natural catalyst for creating a more cohesive working relationship. If the business can implement a smooth and accommodating change in the way these departments work together, the results will follow. How can LP educate or share intelligence with IT to help keep the business protected? LP departments typically have excellent intelligence on the human factors that impact the business. Contractors, suppliers, and even staff turnover are all in view of and understood by LP. By bringing IT into the fold, IT will be better armed with potential breach vectors beyond those that originate from the Internet, but are just as dangerous. For example, if there is a process in place for outside vendors gaining access to systems for maintenance,

LPM 0714-B.indd 48

JULY - AUGUST 2014

LP Magazine interview with Paul Murray Paul Murray, a founder of Wontok, Inc., sets the strategy and direction of Wontok’s solutions development as well as managing operations out of North America. With more than fifteen years’ experience in high tech and telecommunications, Murray combines his technical background with project management and team building. His previous role was CTO of Protel Communications, a company he also cofounded, which was acquired by M2 Telecommunications in 2006.

then both LP and IT should be involved in the process. Not only will this approach help to automate the process, but the entire organization will be more alert to any additional data breach vectors that can then be addressed. What are some ways that IT can educate or share intelligence with LP to improve network protection? This information exchange should start out simple and avoid becoming overcomplicated. Data security can be a complex topic, but it’s critical to remember that a sound understanding does not require a deeply technical comprehension. By gaining clear insight on the basics of sensitive data, how it moves around the network, and how it is stored, LP staff will develop awareness in their day to day. Over time, data will simply become another valuable asset that needs to be protected, similar to merchandise, profits, and brand. How will the new and interactive technology being introduced into the consumer experience influence the need for LP and IT to work together? With technology making its way into all industry sectors, there are great benefits to collaboration between LP and IT. Take customer Wi-Fi for example. There are areas of a retail premises that are clearly off limits to customers, such as offices and stock areas. But when we offer customers access to free Wi-Fi while they shop or dine, have we given this the same degree of thought? If your Wi-Fi is on the same network segment as your back office servers, you might as well have customers passing freely through this area. Collaboration on decisions like this not only limits mistakes, but increases awareness and merges responsibility and expertise. Cooperative efforts should also extend to staff training. By enhancing sales training to include more technical information on the equipment being used and how it can be used against us, we may be more apt at thwarting criminal incidents that may have otherwise gone unnoticed. Why is it so critical for retailers to look beyond compliance to protect the business? Simply stated, being compliant is not the same as being secure. The retailers recently breached were compliant. We need to go above and beyond these regulatory recommendations, work together, and take the necessary steps to be as secure as we can be if we don’t wish to become the next victim. |

LPPORTAL.COM

7/22/14 10:24 AM

FEATURE

ACTIVE SHOOTER IS HAVING A PLAN ENOUGH? By Jacque Brittain, LPC, Editorial Director, Digital

LPM 0714-B.indd 49

7/22/14 10:24 AM

Feature 4 ACTIVE SHOOTER

olumbine High School, Virginia Tech, Sandy Hook Elementary, Fort Hood, Columbia Mall. Active shooter incidents continue to occur at an alarming rate. In fact FBI studies indicate that since the Columbine incident in 1999, such incidents have steadily increased both in frequency and the number of victims involved. These tragic, senseless events remind each of us of the unpredictable nature of troubled minds and the vulnerability that comes with getting caught up in chance circumstances. We grieve for the innocent lives lost and the heartbreak of families shattered. We speculate the motives behind violent exploits and mindless vengeance. But we also internalize the threat and struggle with the realization that we, or our loved ones, could have just as easily filled the faces of the victims. An active shooter is an armed person engaged in killing or attempting to kill people in a confined and populated area, and continues to do so while having access to additional victims. In most cases there is no pattern or method to their selection of victims. These situations are unpredictable and evolve quickly, often with the shooter continuing to move throughout the area until stopped by law enforcement, suicide, or other intervention. Fortunately, these types of incidents don’t happen very often. But the circumstances leading to the confrontation can vary significantly. Understanding how to react if confronted with an active shooter situation is critical. These decisions can quite literally mean the difference between life and death. If you are in harm’s way, you will need to decide rapidly what the safest course of action is based on the scenario that is unfolding before you. However, regardless of the specific situation our goals remain the same: ■ We want to survive the confrontation, ■ We want to reduce the risk that the individual will use the weapon, and ■ We want to minimize the opportunity for anyone to get hurt.

ACTIVE SHOOTER INCIDENTS BY LOCATION

OTHER 12% OUTDOORS 19%

SCHOOL 29%

BUSINESS 40% *Statistics Provided by the Federal Bureau of Investigation 2014

What is the potential threat for incidents in the retail environment? According to statistics gathered by the Federal Bureau of Investigation, 40 percent of all active shooter events

LPM 0714-B.indd 50

JULY - AUGUST 2014

take place in business locations, including retail stores, office buildings, and warehouses. That places retail among the most frequent locations for such attacks. The threat is real, and the concerns are legitimate. However, our concerns don’t stop there. When responding to an active-shooter incident, these same FBI reports note that it typically takes law enforcement seven to ten minutes to arrive on scene. In contrast, it takes active shooters on average three to five minutes to accomplish their intended objectives. Most often, the event is over before assistance arrives. So realistically, who are the first responders? Who carries the burden of following a plan, mitigating the risk, and protecting lives? That responsibility falls on the shoulders of our loss prevention teams, our managers, and our associates. We must have a practical and actionable plan in place to help protect our associates and customers, and keep everyone as safe as possible until help can arrive.

The Importance of a Plan

“You need to have a plan, and practice the plan,” says Jeremiah Hart, lead instructor and senior analyst at the Force Training Institute. “Planning to have a plan is not a plan. There’s a need for leadership. It’s important that we take the appropriate steps to ensure our people are prepared and put the plan in motion.” Research clearly indicates that practice and preparation are critically important when responding to incidents that involve workplace violence, especially when dealing with situations involving a weapon. When faced with a traumatic, highly stressful situation, an untrained Jeremiah Hart response can be highly unpredictable and may put us at greater risk. As the situation unfolds, our stress can mount and our anxiety can intensify. Rash or impulsive responses can lead to poor decisions and regretful outcomes. What we need is a practical and responsible plan of action that helps guide us through these traumatic situations. Practice and preparation can help us organize our thoughts. It can have a significant impact on the end result by helping us to overcome some of our initial anxiety, recall valuable information that can help us through the situation, help prepare us for the situation we are facing, and ultimately build the foundation that supports our commitment to act. Knowing how to respond is the first step in keeping everyone safe. Hart, who appeared at the Retail Industry Leaders Association’s (RILA) Asset Protection Conference in April, has worked with numerous retail organizations and Fortune 500 companies to create and implement active-shooter mitigation programs. He is also a police sergeant in Los Angeles County and has testified as an expert in law enforcement training, policies, procedures, and use-of-force issues. LP Magazine recently sat down with Hart, who offered many valuable insights that can improve our programs and help save lives. Many retailers today have put plans to paper. We put great effort into taking the necessary steps to spell out what may happen, where |

LPPORTAL.COM

7/22/14 10:24 AM

Feature 4 ACTIVE SHOOTER

Teaching employees what to say when calling 911 during an active-shooter episode is vital, and should be part of practical training sessions. State the facts and don’t make assumptions. Police can respond more quickly and appropriately when they have a clear understanding of the circumstances and the urgency of the situation.

The Value of Practical Training

“To create a true culture of safety, there has to be a common sense approach,” Hart states. “Talking about the issue is a good step, but practical training is much more valuable. Following the steps and practicing simple techniques that can be recalled under stress can save lives.” Hart strongly urges that we need to take the time and make the effort to validate that the plan works, and ensure that our teams know how to respond. This has to go beyond a plan that is committed to paper, or simply sending a document, policy, or file that our associates sign acknowledging it has been read and received. This must be approached as an actionable learning experience. “During a crisis, people don’t typically rise to expectations, but fall to the level of their training,” he emphasized. “Abnormal responses to abnormal situations are normal responses.” Although our plans may be reasonable and strategic, we must also consider that such situations are not; and simply reviewing a written plan may not lead to the results that we expect. We can’t assume that people are going to react in the manner that we anticipate just because we provide them with a document that describes how we believe they should respond. For example, we may tell our associates to run or hide during an active-shooter incident, which experts tell us is the correct initial response. However, as an actual situation unfolds, stress mounts, and anxiety intensifies. This may lead to confusion, panic, disbelief, denial, and even a feeling of helplessness. Especially if we haven’t been adequately trained, we may react to this in different ways, and running or hiding may not necessarily be our initial reaction. In fact, freezing can be a very common response. Practical training and simple exercises can help commit actions to memory, stress that employees need to run, and help others who may freeze. Even if it’s simply the importance of yelling, “Run!” to others as they flee the scene, these exercises can save lives. “We tell our people to be aware of gunfire, but do they actually recognize the sound of gunfire? Very few people do.

It’s not like on television. It can sound like a balloon popping, a pounding hammer, or other construction sounds that are very common in store locations. Also, gunshots can sound different depending on the environment. The sound may be different in a big-box store versus a small store, in the mall space, as well as inside versus outside. Employees should also know what gunfire smells like.”

ACTIVE SHOOTER EVENTS BY YEAR 25

Number of Events

we should go, who we should contact, and how we should respond. We then provide the plan to the stores, where the information is shared with the team. On paper the plan may appear to be strong, reasonable, and strategic. But is it? Do we consistently take the next step?

20 15 10 5 0

2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012

Year *Statistics Provided by the Federal Bureau of Investigation 2014

Hart suggests contacting law enforcement agencies and requesting that they visit during off-hours with employees in attendance and shoot off blanks in different environments. These types of exercises can provide opportunities for multiple stores or companies to attend, improve rapport, and further build relationships with other store teams, local police, and other emergency responders. It may be emphasized in our training guidelines that if you’re going to hide, lock the door behind you and barricade it when possible. But as simple as this may sound, employees may experience difficulty under stress. Some struggle locking the door, especially if it’s a door that’s not familiar to them. Some doors in our facilities simply may not have locks. Hart also recalled an incident at a hospital where he asked a nurse, “Show me where you would go and what you would do if you encountered a shooter.” She pointed to a room and

LP MAGAZINE | JULY - AUGUST 2014

LPM 0714-B.indd 51

continued on page 52

7/22/14 10:24 AM

ACTIVE SHOOTER

introducing

summit series According to statistics gathered by the Federal Bureau of Investigation, 40 percent of all active shooter events take place in business locations, including retail stores, office buildings, and warehouses. That places retail among the most frequent locations for such attacks. The threat is real, and the concerns are legitimate.

the next generation of cloud-based cash management systems

continued from page 51

the New Summit SerieS of CaSh maNagemeNt SafeS offer: • Intuitive touch pad interface • Web-based reporting • Complete remote management suite • Plug and play installation • Solid state architecture • Blowfish cipher encryption for secure communications • Integrated high speed thermal printer • Dual bill validators with standard or high-capacity cassettes featuring single note or bulk note feeds • Self clearing capability • Modular hot-swap service design • Compact footprint

to learn more, contact us at: (800) 342-3033 ext. 5335 info@apunix.com

said that she would move a heavy filing cabinet against the door. However, not only was the cabinet too heavy for her to move on her own, when they tried to move it together they discovered it was bolted to the floor. How might such decisions play out in a real-life situation? A simple walk-through with employees doesn’t take much time, but can be extremely valuable. Every plan should consider the design and limitations of the location in addition to the potential response of customers and employees. While by no means all-inclusive, here are some additional questions that should be answered as part of practical training exercises: ■ Are you familiar with all of the potential exits in your building? Are the exits clear? ■ Do you have an escape route and plan in mind? ■ Do you know where those exits go, and whether they take you out of the building? ■ Where would you go once you exited the building? ■ Are the floor plans for the building up-to-date? ■ How would you respond if the shooter was on a different floor in the building? Would it matter which floor? ■ Have you considered which rooms in the store would provide the greatest protection? Which would provide the least protection? ■ Do you know which doors in the building have locks, and those that don’t? What kind of locks do the doors have? Key, push button, push and turn, or other? ■ When choosing a place to hide, have you considered the difference between cover and concealment? ■ Do you know how to quickly silence your cell phone? ■ When should you come out of hiding? ■ How would you respond if you were directly confronted by the shooter?

Visit Us at RLPSA Booth #503

LPM 0714-B.indd 52

JULY - AUGUST 2014

continued on page 54 |

LPPORTAL.COM

7/2/13 4:49 PM

7/22/14 10:24 AM

The Analytics Ecosystem for Retail

Enterprise solutions to reduce risk and protect profits Case Management

Additional solutions to explore • Employee Training and eLearning

audit Store and Compliance Auditing POS Exception Reporting

• Background Checks and Screening • P&C Claims Analysis, Reporting and Investigations • Driver Risk Management and Screening • Chemical Regulatory and Compliance

Law Enforcement Retail Partnership Network

• Weather Risk Management • Medicare Secondary Payer Compliance • Catastrophe Modeling

Cargo Theft Prevention and Recovery

LPM 0714-B.indd 53

• Healthcare Risk Management • Location Risk Information

Learn more!

veriskretail.com 888-777-0585

7/22/14 10:24 AM

Feature 4 ACTIVE SHOOTER

OTHER 9%

ACADEMIC 23% NONE 22% PROFESSIONAL 41%

together, from how we deliver merchandise, how merchandise will be displayed, and how to best service our customers. We have to consider the market and demographics where the store is constructed. We look at the type of customers that our stores will attract. We have to determine the size of the staff, and how the staff will be best constructed to meet store and customer needs. We need to consider how to build our store management, as well as support teams and leadership both within the store and within our market areas…All of these factors, and many others, determine how the store will be put together, and how it will operate. There is no single retail model, because we sell different products and attract different customers. Why then would we assume that our active-shooter strategies should be bought off-the-shelf and applied universally? Of course, a single model won’t collectively meet every need. The basics will apply and the concepts will be similar, but the application will differ slightly based on the dynamics of the store. Some stores may have a large support staff to include loss prevention, while others may only have a few employees running the entire store. Some stores may have vast areas to protect and multiple offices that are available, while others will have a small showroom and may not even have an office with a locking door. Incidents may not necessarily occur in a large department store. Incidents occur at grocery stores, convenience stores, and hardware stores. A recent incident at a Maryland mall occurred in a small surf shop with just a few employees. This only further emphasizes the need to construct a plan that best fits the store and the environment, and carrying out practical training exercises that will effectively protect our employees and our customers. Our model and strategy must fit our individual needs and teach our associates to appropriately respond based on the environment as well as the particular circumstances.

See Something, Say Something

A New York Police Department analysis showed that the majority of active-shooter attacks occurred when the perpetrator had either a professional or academic relationship with at least one of the victims. However, 22 percent of active-shooter attacks in the research data occurred when the shooter had no relationship to the victims. *Source: Active Shooter: Recommendations and Analysis for Risk Mitigation, New York Police Department continued from page 52 ■ How

should you respond if confronted by a police officer? If asked to describe the shooter and the situation, what information would you provide? If you were to consider the layout of your store, the location of the store, the demographics of your typical customers, and the makeup of your employee teams, what additional questions should you ask? ■

“Off the Shelf” Doesn’t Work

As we’re all very well aware, retail is not a “one-size-fits-all” proposition, and that goes far beyond the size and shape of the store. When putting together the store, we have to consider the products that we sell and how the store needs to be put

LPM 0714-B.indd 54

JULY - AUGUST 2014

“See Something, Say Something” is a good reminder and a positive message. It reminds us to keep our eyes open and to speak up when something appears odd or out of place. By the same respect, it’s important to recognize what may be considered odd or out of place, and who should be told. “At Virginia Tech the shooter was seen chaining doors closed just days before the 2007 massacre took place,” Hart recalls. “Those were actually his ‘training runs.’ Although witnesses later admitted thinking that the behavior and what they saw was odd, they didn’t report it.” Similarly, after other active-shooter incidents witnesses have told investigators, “The guy wearing the hockey mask in the mall was a little strange,” and “The man wearing a heavy trench coat in an office building in June was weird,” but they paid little attention to what they saw. Do people shop that way? Does their dress and behavior fit the situation? If not, say something. “Hear Something, Say Something” can be just as important. Hart cited the case of a car dealership manager that overheard a female employee tell a coworker, “If my ex comes into the showroom with a gun, you need to be my witness.” The manager didn’t act on the information. Later that very day the ex did enter the dealership, fatally shot the woman and the manager, and injured several others. |

LPPORTAL.COM

7/22/14 10:24 AM

Feature 4 ACTIVE SHOOTER

It may be emphasized in our training guidelines that if you’re going to hide, lock the door behind you and barricade it when possible. But as simple as this may sound, employees may experience difficulty under stress. Some struggle locking the door, especially if it’s a door that’s not familiar to them. Some doors in our facilities simply may not have locks. Teaching employees what to say when calling 911 during an active-shooter episode is vital, and should be part of practical training sessions. State the facts and don’t make assumptions, such as “There is a man in the store shooting at people. At least two people have been shot. He’s dressed in black and carrying a handgun.” Police can respond more quickly and appropriately when they have a clear understanding of the circumstances and the urgency of the situation. “Workers should also not come out of hiding places until instructed to do so,” says Hart. “While this could take hours, they should wait until the scene is secured. They don’t want to be mistaken as potential suspects rather than potential victims when law enforcement arrives on the scene.”

Internalizing the Message

Every active-shooter training program carries similar intentions—to save lives and keep people safe. Some of the

information may not be new, but the message should be clear. In these situations, we can’t afford to make assumptions. We should take every reasonable step to give our employees and our customers the best opportunity to survive these events. If we don’t have a program, we should. If we do have a program, it doesn’t hurt to take another look to make sure that we got it right. Hart himself has managed active-shooter crime scenes. “Seeing the heartbreak and devastation in the families of the victims is overwhelming,” he says. “It’s real and it’s difficult. It stays with you as a harsh reminder. I decided that I would do everything in my power to avoid these types of tragedies from happening again. “Too many of us think that, ‘It’s never going to happen to me, it’s never going to happen here.’ We don’t want to talk about it. We don’t want to think about it. But if and when it does happen, we’ll count our blessings that we were prepared. When you share the gift of safety, people take that gift with them wherever they go.”

Is theft eating away at your profits? Put the Civil Recovery Law Firm on the case. You’ve worked too hard to let someone else walk away with your profits. Recover your losses. For over 20 years, the experienced legal team at Palmer, Reifler and Associates has served our clients by providing sound legal representation, exemplary client service, and optimal recovery performance.

Doesn’t your business deserve the protection of the law?

Toll-Free in the U.S.: 866.875.6565

LP MAGAZINE | JULY - AUGUST 2014

LPM 0714-B.indd 55

7/22/14 10:24 AM

SOLUTIONS SHOWCASE BASS SECURITY

Your Fire Alarm System Can Do More Than Just Detect Fires By Todd Domer, SET, Technical Director, Fire Alarm and Intrusion, Bass Security

ll too often, a fire alarm system is looked at as a necessary evil. After all, it spends the majority of its time hanging on the wall in silence. You interact daily with the security system, access-control system, and CCTV system, but the fire alarm panel just quietly stands by. The reality is that you must meet the Americans with Disabilities Act (ADA) requirements. Furthermore, the fire alarm system is a very important part Todd Domer of your risk management and often times only the most basic systems are installed to simply “meet code.” When you have multiple sites across several states, there is a sizeable chance that there are authorities having jurisdiction (AHJ) that will require you to install more than just a minimal code compliant system. The National Fire Alarm and Signaling Code NFPA 72 requires fire alarm systems to be tested by certified individuals. It also gives the requirements for strobe candela ratings and horn sound levels to help you meet ADA requirements. Once you have installed more than just a minimally compliant code system in one store, the case could be made that you should bring all stores up to that same level of coverage. This is one instance where risk mitigation comes into play—are you giving the same level of safety consistently across all of your sites?

Integrating a Carbon Monoxide Detector with your Fire Alarm System

In addition to making sure all of your sites have the same level of safety for fire and alarm systems, it is important to look at another risk mitigation device. The CO (carbon monoxide) detector has not previously been thought of as being integral to a fire alarm system. However, that is quickly changing given the potential danger of CO poisoning. Anywhere that you have gas-fired appliances, such as HVAC units and water heaters, you have the possibility of CO poisoning. More cities and states are passing legislation to require CO detectors in commercial establishments. As recently as February of this year, a restaurant manager in a New York mall was killed by CO poisoning. Twenty-seven people were taken to the hospital including seven fire department personnel. According to the Centers for Disease Control and Prevention (CDC) Morbidity and Mortality Weekly Report, “Carbon monoxide (the ‘silent killer’) sends 15,000 people to the hospital every year, and it kills an average of 500 U.S. citizens annually.” Information contained within the report is intended to increase

LPM 0714-B.indd 56

JULY - AUGUST 2014

Today, more manufacturers are integrating the fire, security, CCTV, access control, and EAS systems to use the technology to decrease the risk. Bass Security Services is the one-touch solution that can offer all of these technologies. awareness. It might even save your life or the lives of friends or family members. Awareness is the key. I believe this is where your fire alarm panel can do more for you. Several fire alarm manufacturers have developed combination photo smoke/CO detectors. By code you are required to have a smoke detector above your fire alarm control panel, and now you can add a CO detector for very little additional cost. An additional bonus is that this CO detector would give a distinct signal at the premises and would be monitored so the fire department would be called immediately to evacuate the site. Future technology will be able to use video to monitor fire and smoke detection. Today, more manufacturers are integrating the fire, security, CCTV, access control, and EAS systems to use the technology to decrease the risk. Bass Security Services is the one-touch solution that can offer all of these technologies. I suggest it is time to let the fire alarm panel and the CO detector do more than just hang quietly by. Let it do more to help you mitigate risk. For more information please visit bass-security.com or call 888-774-3400.

LPPORTAL.COM

7/22/14 10:24 AM

SOLUTIONS SHOWCASE CHECKPOINT

Why EAS Helps Food Retailers Deliver a Superior Customer Experience

hopping for groceries and other food-related items is one of the most standard consumer activities in the world. But shopping in grocery stores and supermarkets is hardly a static activity. Food retailing has been greatly influenced by such factors as the rise of private-label brands; diversification of food categories, such as organic produce, premium meat, and seafood; prepared foods; and the increase in grocery items carried by mass merchants, deep discount, and convenience stores. As the grocery environment continues to evolve, consumers have a wider assortment of products to choose from, and more options on where to do their weekly shopping. Supermarkets are shifting strategies to continue to serve their customers and keep them coming back. Shrink management has been a major focus for food retailers over the years. Losses due to theft, spoilage, and product waste continue to impact margins and profits. The Global Retail Theft Barometer revealed that shrink accounted for 1.3 percent of retail sales in food retail outlets with certain high-risk items, such as cheese, meats, seafood, and baby formula, often experiencing shrink rates more than double the average rate. Now, as retailers provide more premium grocery options and prepared foods, managing product freshness and quality becomes even more critical. In addition, as retailers expand their merchandise assortments into higher-margin health, beauty, and in-store pharmacy items, even at average-shrink levels the losses negatively impact the bottom line at a higher disproportionate level. As a result food retailers are looking for innovative ways to combat shrink while delivering a modern, welcoming customer experience. Although many grocery store chains and food supermarkets have installed electronic article surveillance (EAS) systems, many of them haven’t upgraded their technology or kept up with their programs in favor of customer service initiatives. This can be counter-productive, since EAS reduces theft, which in turn reduces out-of-stocks, resulting in a better shopping experience. EAS can have a positive impact on the customer experience in three ways: 1. Deterrence—Supermarkets have found that when EAS is visible within a store (labels on product packaging, pedestals at store entrances), it deters casual theft, resulting in lower shrink, and by result, lower out-of-stock situations on key merchandise. 2. Deactivation—Intelligent deactivation systems can enhance the shopping experience by shortening checkout lines and enabling mobile and self-checkout options. In addition, consistent and

reliable deactivation of EAS labels virtually eliminates false alarms and damaging embarrassment of honest shoppers at the store exit. 3. Detection—Today’s EAS antennas and tags offer advanced detection, even with most creative tactics used by organized retail crime (ORC) gangs. Combined with the reliability of intelligent deactivation, your store associates now can have the confidence that an EAS alarm actually means a shoplifting attempt—not a potential false alarm of an honest shopper—and can respond accordingly to their store policies.

A comprehensive EAS program also supports open merchandising, enabling shoppers to handle and conveniently purchase items without the assistance of store personnel. EAS solutions secure high-risk items, without the need for locked cabinets to protect merchandise. Category-specific protection includes enhanced performance clear labels for small cosmetic items, tamper-proof labels for over-the-counter medication, keepers for razor blades, and bottle locks for alcoholic beverages among many other type of applications. Finally, EAS technology has achieved consistent improvements in accuracy, reliability, functionality, and aesthetics, including the ability to display customized, high-quality promotional graphics on sleek EAS antenna pedestals, or clear antennas that can be installed at each checkout lane without obscuring the view of the cashier. Many retailers undergoing new store openings or periodic store remodeling projects have found that is also an ideal time to upgrade their visible EAS infrastructure in order to align with new store designs. Recent enhancements in EAS technology and development of financial ROI tools make it possible to measure the impact a comprehensive EAS system might have on a supermarket bottom line. Grocery stores and supermarkets are under more pressure than ever to improve profit margins, continue shopper loyalty, diversify their merchandise mix, and ensure a positive customer experience. EAS solutions can be an effective way to achieve those goals and make their stores more efficient in the process. For more information about modern EAS solutions for grocery stores, supermarkets, and other food retailers, please visit: checkpointsystems.com/industry-solutions/ supermarket-hypermarket.aspx.

LP MAGAZINE | JULY - AUGUST 2014

LPM 0714-B.indd 57

7/22/14 10:24 AM

SOLUTIONS SHOWCASE DIEBOLD SECURITY

Enhance Security Visibility and Management across Your Retail Footprint By Jeremy Brecher, Vice President, Technology, Diebold Security

n the world of loss prevention, visibility is key. Extending far beyond traditional surveillance, retailers need fast, easy access to security video and information, as well as the ability to conveniently administer alarm, access, incident, and asset management systems. Visibility of these systems is often fragmented by a vast array of platforms, all with different interfaces. Finding the most relevant information and managing these varied platforms can be laborious and inefficient. Diebold’s SecureStat delivers the unified visibility retailers need to provide actionable data to protect and manage their operations—all from one platform. This centralized, web-based security management portal provides a single interface for real-time information and administration of all security-related systems. It delivers Jeremy Brecher a single customizable dashboard to improve the visibility—and simplify the management—of every connected system across your entire retail footprint. With its accessibility from any web browser on any device, SecureStat delivers real-time visibility with actionable data to effectively manage the security operations of your stores, warehouses, and offices from wherever you are.

Manage Any Security System from Anywhere, from Any Device

SecureStat is a product-agnostic solution, allowing seamless integration of your existing hardware, software, monitoring, and other managed services into the platform regardless of the manufacturer. Since SecureStat was built from the ground up as a stand-alone solution, its flexibility allows you to implement the equipment of your choice without limiting your options. SecureStat also operates on all major browsers, desktop computers, tablets, and mobile devices, ensuring you can access the system anytime from any location. This capability supports today’s bring-your-own-device (BYOD) trend, without requiring specialized software. Anywhere, anytime access allows you to share visibility and control with your individual locations, increasing the mobility of security systems by consolidating relevant field information and tasks into one mobile view. Immediate access to resources via SecureStat’s online interface enhances the visibility of your security operations. For example, you can access SecureStat from your smartphone to verify an alarm as it’s happening or place a location on test. You can gain immediate access to monitoring history, site information, documents, hardware inventory, and other

LPM 0714-B.indd 58

JULY - AUGUST 2014

SecureStat operates on all major web browsers, desktop computers, tablets, and mobile devices ensuring access from anywhere, anytime.

system data. In addition, you can perform tasks such as updating user codes and access cards in real time.

Customize Your Security Operations

Beyond choosing your preferred hardware, software, and services, SecureStat enables you to incorporate custom-built functionalities and integrations to suit your unique security needs. SecureStat features the security industry’s first Development Zone Portal. Through the portal, you can access numerous application program interfaces (APIs) that allow you to extend functionality and integrate systems, hardware, and information, enabling collaboration across departments, stores, and organizations. The portal allows Diebold, its customers, and partners to quickly innovate, deploy new technologies, and share information at an application level. Any new functionality you deploy expands SecureStat’s capabilities and can boost the visibility of security across your retail outlets, warehouses, distribution facilities, and administrative offices.

Expand at Any Time

SecureStat’s flexible web services architecture gives you room to grow as your security needs evolve. The solution enables rapid migration to future technologies, as well as the application of new data analytics across multiple information sources. In addition, SecureStat is scalable, allowing you to easily expand the number of sites, security systems, and services covered—adding even greater visibility for your loss prevention operations. Access to SecureStat is free to Diebold monitoring and service customers. Learn how SecureStat can help your company enhance the visibility and management of your retail security operations by contacting Diebold at 855-331-0359 or visiting Diebold.com/SecureStat. |

LPPORTAL.COM

7/22/14 10:24 AM

LPM 0714-B.indd 59

7/22/14 10:24 AM

INDUSTRY NEWS

Yearning for a Different Job? C

areerCast.com, a well-known job search website, recently published its 26th annual Jobs Rated report, ranking 200 jobs from “best to worst” based upon a combination of objective and subjective metrics for which they devise an overall score—the higher the score, the worse the job. They also publish subset lists, such as “The Best Jobs for Introverts” or “10 Best Jobs without a Degree.” CareerCast analysts review a wide range of critical aspects and categorize them into four “core criteria” that are inherent in every job—environment, income, outlook, and stress. Each core category includes a range of sub-factors that serve to explain and help quantify it. For instance, “physical demands,” such as bending, stooping and carrying, is integrated into the environment score. Scores for items like “amount of travel” and “hazards encountered” are included in the stress-level calculation. Interestingly, the core criteria are not equally weighted. Since most of us work mainly to earn a living, the most important and higher weighted criteria are income and the hiring outlook. The assumption is we would work at a job that has a high income and a good long-term outlook, and more readily accept the negatives, such as stress, physical demands, personal risk, or bad working conditions. Jobs with pleasant working conditions, low stress, and good future hiring prospects are highly rated. The dangerous, stressful, and unpopular jobs, like yours, are piled up in the bottom quartile—culminating with lumberjack at 200.

by Robert L. DiLonardo DiLonardo is a well-known authority on the electronic article surveillance business, the cost justification of security products and services, and retail accounting. He is the principal of Retail Consulting Partners, LLC (retailconsultingllc.com), a firm that provides strategic and tactical guidance in retail security equipment procurement. DiLonardo can be reached at 727-709-6961 or by email at rdilonar@tampabay.rr.com.

type and breadth of jobs appearing for the first time, such as mobile app designer, or drop off, such as blacksmith. This year, a regulatory shift—the passing of the Affordable Care Act—is having an enormous impact on the healthcare job market. Combined with the fact that about 10,000 Baby Boomers qualify for Medicare daily, these trends are likely to continue for the next several years. CareerCast also notes that technology is, once again, having an impact on the demand, compensation, and environment of a job. It’s also a rewarding career path all its own, as evident by the ranking of IT jobs throughout the top 100.

Retail-Related Jobs

Twelve jobs are related directly or well-correlated to retail. The highest ranked job is human resources manager (13). There are no other retail-oriented jobs in the top fifty and just four jobs ranked in between 50 and100. The other seven are ranked in the bottom 100. If you think that “mahogany row” might be a good gig for you, cashier (107) ranks much higher than corporate executive [senior] (132). But the pay differential is very wide—$19,000 to $102,000. A purchasing manager (152) edges the sales person [retail] (153) and the buyer [wholesale/retail] (167).

Looking Inward

Topping the main list for 2014 are mathematician (1), university professor [tenured] (2), and statistician (3). All metrics are extremely positive—great work environment, no stress, plenty of jobs on the horizon, and decent pay, ranging between $69,000 and $101,000 per year. The best twenty jobs fall into six general categories— academia (2 jobs), insurance (3 jobs), healthcare (8 jobs), engineering (2 jobs), information technology (3 jobs) and general business (2 jobs).

An article like this starts us day dreaming about changing careers…again! We’ve all been there more than once, me included. We muse wistfully at the list and flash back to the time when our life’s page was blank, and we could make any choice in the world. At this point maybe we’ve finally decided to explore a field that inspires our inner passion about something. It’s never too late. So, I decided to check out the list to see where I had been, and what I might do when I finally grow up. As it turns out, I have held ten of these jobs, ranging from accountant (40) to enlisted military (198). I dreamed of six others, ranging from economist (18) to actor (151). Management consultant (63), my current career path, has been great. It will be difficult to replace.

Outside Influences

Amusing Anomalies

Best Three

Over time, economic, technological, regulatory, social, cultural, and demographic changes in society impact the

LPM 0714-B.indd 60

JULY - AUGUST 2014

■

There are a few anomalies that gave me a chuckle. Disc jockey (188) is rated lower than policeman (187). LPPORTAL.COM

7/22/14 10:24 AM

Corrections officers (191), firefighters (192), and garbage collectors (193) have better jobs than flight attendants (194) ■ Newspaper reporter (199) is down at the bottom, along with taxi driver (197), enlisted military personnel (198), and lumberjack (200). ■ In the “irony” category, tied for 179th are military general and butcher. The general earns seven times more money (for good reason). Neither has a particularly good hiring outlook. I am, however, worried about the prospects for my magazine bosses. Here’s a direct quote from CareerCast. “Of course, much can change in the rankings of our Jobs Rated report over 26 years. Consider publication editor. Just 12 years ago, it ranked 31st overall. It checks in at 139 in this year’s Jobs Rated report.” The stress level has risen dramatically, the hiring outlook has worsened, and the pay isn’t that good, either. Why are we doing this again? ■

Background Screening Benchmarking Report The Retail Industry Background Screening Benchmarking Report has revealed a healthy respect for EEOC guidance and a keen understanding of what checks are necessary for what positions. The report takes an in-depth look at retailers’ background check habits including what checks are run, what positions are screened and how retailers are reacting to EEOC guidance. In addition to looking at what checks are currently used, it looks into what checks retailers want to increase or decrease their use of background checks as compared to years past. “For a long time, background screening was focused on more— more types of checks, done on more employees. With EEOC guidance, all industries have to switch their focus to doing the right checks on the right employees, and the retail industry is

at the head of the pack,” says Matt Robbins, vice president at GIS. In addition to showing what services are used, the report also shows why retailers are performing background checks. Retailers were asked to rank their various reasons for performing background checks, showing that safety is their biggest concern: ■ Safer work environment ■ Hire better employees ■ Customer safety ■ Shrink reduction ■ Protect brand and image Retailers can request their copy of the report now by visiting theftdatabase.com/benchmarking.

U.S. Retail Fraud Survey The U.S. Retail Fraud Survey 2014, now in its second year, is an extensive study of the retail fraud and loss prevention systems, processes, and strategies employed by 100 of the United States’ top retailers. The survey reveals that theft of cash from U.S. retailers has soared by a staggering 20 percent, while the number of stores using secure storage at POS dropped by 35 percent. While suggesting that the reduction in use of secure POS is directly responsible for the dramatic increase in cash shrink would be to oversimplify a complex issue, those retailers affected may well wish to review their cash-handling systems in the light of this information and reexamine how they store, validate, count, and move their cash; both around their stores and to their bank. Other areas of store loss highlighted by the survey include: ■ Employee theft is identified as the biggest area of store loss at 38 percent of shrink. ■ Administrative and bookkeeping errors account for the third biggest area of loss at 21 percent. ■ Shoplifting is the fourth biggest area of loss in stores at 11 percent. Download the survey and executive summary by going to retailfraud.com/survey. LP MAGAZINE | JULY - AUGUST 2014

LPM 0714-B.indd 61

CASH HANDLING/SAFES

RESTORATIVE JUSTICE

A COLLABORATIVE SOLUTION TO RETAIL THEFT • Led by retailers • Approved by law enforcement • Sanctioned by prosecutors

w w w. t u rn i n g p o i n t j u s t i c e . c o m

1. 8 8 8 . 4 6 6 . 2 2 9 9

7/22/14 10:51 AM

PEOPLE ON THE MOVE

CALENDAR

August 3 – 6, 2014 Restaurant Loss Prevention & Security Association 2014 Annual Conference Caribe Royale Hotel, Orlando, FL rlpsa.com

Richard Nafefar was made Regional LP Investigator for A’GACI.

August 12 – 13, 2014 Axis Communications 3rd Annual Retail Leadership Forum Hotel Monaco Seattle, WA hedgie.bartol@axis.com

Tom Stein, CFI, LPC was made Director of Risk Management and LP for Areas USA.

September 8 – 10, 2014 Consumer Returns Westin Galleria, Dallas, TX consumerreturnsusa.com September 9 – 10, 2014 International Supply Chain Protection Organization Annual Conference Texas Scottish Rite Children’s Hospital Conference Center, Dallas, TX iscpo.org/conference September 10 – 11, 2014 Retail Council of Canada Retail Loss Prevention Conference Toronto (ON) Congress Centre retailcouncil.org September 18, 2014 Retailers Association of Massachusetts New England ORC Symposium and Tradeshow DCU Center, Worchester, MA retailersma.org September 18, 2014 NYC Cyber Security Summit New York Hilton Midtown cybersummitusa.com September 29 – October 2, 2014 ASIS International 60th Annual Seminar and Exhibits Georgia World Congress Center Atlanta, GA asisonline.org October 10 – 13, 2014 Coalition of Law Enforcement and Retail (CLEAR) 5th Annual Training Conference San Diego (CA) Marriott Mission Valley clearusa.org October 13 – 15, 2014 Loss Prevention Research Council 10th Annual Impact Conference University of Florida, Gainesville lpresearch.org November 19 – 20, 2014 ISC East Javits Center, New York City isceast.com

LPM 0714-B.indd 62

Robert Sanchez, Jr., CFI was appointed Director, Operations LP for Amtel.

William Nichols was appointed Vice President of LP for Bowlmor AMF. Britt Henry, CFI is now Regional LP Manager for Cato Corp. Trevor Eynon, LPC and Stephen Brady were made Regional LP Managers for The Children’s Place. Sergio Martinez, CFI was appointed Divisional LP Director for Dollar General. David Johnston was appointed Senior Director of LP and Corporate Security for Dunkin’ Brands Group. Kelvin Davis is now Director of Risk Management for EH&S, Casualty Claims for Family Dollar. David Brightly was appointed Vice President, LP and Safety for FleetPride. Michelle Hahn was made Operations Manager for LA Fitness. Zachary Smith was made Senior Manager of LP for Lucky Brands. Todd Worthy was appointed Vice President, Northeast Operations for Brink’s. Joaquin Farrell is now a Regional LP Manager for Gap. Tim Lapinski, CFI was appointed Director of LP and Safety for Helzberg Diamonds. Michael Alves is now a Regional LP Director for Kohl’s. Howard Weisel is now a District Manager of LP and Safety for Lowe’s. James Dwyer, CFI was made Zone Manager of LP and Safety for Michaels Stores. Robert Moraca, CPP, MBA was appointed Vice President of LP for the National Retail Federation.

JULY - AUGUST 2014

Jeff McPike, CFI was made Director of Labor and Process and Laroussi Elyaddasse was named Director of North America LP for Nike. Leo Cabral, CFI was made Manager, LP West for Penske. David Niesen was made a Director of HR Store Ops/Services for PetSmart. Scott Ziter was appointed Director, LP and Safety for Price Choppers Supermarkets. Suni Shamapande was named Director for PricewaterhouseCoopers. Pierre Simon is now a Market AP Specialist for REI. Regis Corp has announced that Heather Shanosky and James Elliott, CFI are now Regional AP Managers, and Paul Votto was made a Regional AP Investigator. Jayson Sutton was appointed Senior Director of LP for Ross Stores. Paul Meinholz is now an LP Manager for The Swatch Group. Marc Holtman is now an LP Business Partner, and Theresa Roswell was made Group AP Team Leader for Target. Brian Csorba, CFI was made Senior Manager, LP Field Operations for T-Mobile. Michael Currier was named Associate Director of Corporate Security for Verizon Wireless. Joe Davis, CPP, CFI, LPC was made Regional AP Manager for Walmart.

To stay up-to-date on the latest career moves as they happen, sign up for LP Insider, the magazine’s weekly e-newsletter, or visit the People on the Move page on the magazine’s website, LPportal.com. Information for People on the Move is provided by the Loss Prevention Foundation, Loss Prevention Recruiters, Jennings Executive Recruiting, and readers like you. To inform us of a promotion or new hire, email us at peopleonthemove@LPportal.com.

LPPORTAL.COM

7/22/14 10:24 AM

LPM 0714-B.indd 63

7/22/14 10:24 AM

ADVERTISERS

Subscribe for Free

Agilence................................................................ 33 agilenceinc.com/retail-2020-solution Alpha...................................................................... 17 alphaworld.com American Military University............................. 13 amuonline.com/lpf Axis Communications............................................ 7 axis.com/retail Bass Security....................................................... 25 bass-security.com Checkpoint............................................................ 19 checkpointsystems.com ClickIt Inc.............................................................. 31 clickitinc.com Contact, Inc........................................................... 26 contactinc.com Corrective Education Company........................... 9 correctiveeducation.com Detex...................................................................... 43 detex.com/go/230xmax Diebold Security................................................... 23 diebold.com/lpmagazine FireKing Security Group...................................... 52 fireking.com InstaKey................................................................. 46 instakey.com Intelligent Loss Prevention................................. 42 intelligentlossprevention.com International Assoc. of Interviewers................ 63 certifiedinterviewer.com Kenwood............................................................... 22 kenwoodusa.com/protalkinfo LockUp................................................................... 21 lockup.com Loss Prevention Foundation............................... 45 losspreventionfoundation.org LPjobs.................................................................... 59 lpjobs.com

MAGAZINE

LP Magazine is available free to loss prevention and retail professionals throughout the U.S. and Canada. There’s no excuse for anyone interested in keeping up with the LP industry to not get the magazine.

International Subscription. LP professionals outside the U.S. and Canada can either read the digital magazine free or receive the print version for $99 per year. Visit the Subscription page at www.LPportal.com to purchase an international subscription.

To sign up for a free subscription, go to www.myLPmag.com. It’s simple. Takes only a minute. Or fax the completed form below to 714-226-9733. ❍ Y es, I would like to receive/continue to ❍ Y es, I would also like to receive/continue to ❍

receive LP Magazine FREE of charge. No thanks.

❍

receive your e-newsletter FREE of charge. No thanks.

Please fill out completely: Signature___________________________________________________________ Date___________________ Telephone__________________________________________________________________________________ Fax________________________________________________________________________________________ Email_______________________________________________________________________________________ First__________________________ Middle______________________Last______________________________ Title________________________________________________________________________________________ Company___________________________________________________________________________________ Address1___________________________________________________________________________________ Address2___________________________________________________________________________________ City________________________________________________________________________________________ State/Province__________________Zip/Postal Code____________________Country

❍ USA ❍ Canada

You must answer both questions to receive LP Magazine 1. What is your company’s primary business? (Check one only) Retail ❍ (A) D epartment store/mass merchandiser ❍ (B) D iscount/wholesale club/outlet/

2. What is the primary focus of your job? (Check one only) Retail Loss Prevention/Security ❍ (10) C orporate/regional/district manager ❍ (11) S tore LP manger/investigator/

Palmer, Reifler and Associates......................... 55 palmerreiflerlaw.com

❍ (C) S pecialty apparel/footwear/gifts/

❍ (12) DC/logistics/supply-chain

Protos Security....................................................... 3 protossecurity.com

❍ (D) H ome center/hardware/appliances/

❍ (19) Other LP manager

The Retail Equation................................................ 5 theretailequation.com/success

❍ (E) Drug store/pharmacy/vitamins ❍ (F) Office supplies/electronics/videos/

Other Retail ❍ (20) C orporate operations/store manager ❍ (21) F inance/HR/legal/IT/training manager ❍ (29) Other retail manager

Milestone.............................................................. 47 milestonesys.com NuTech National.................................................... 2 nutechnational.com

Salient Systems.................................................... 35 salientsys.com Security Resources............................................. 67 securityresources.net Sysrepublic............................................................. 1 getyourprofitsback.com Turning Point Retail............................................. 61 turningpointjustice.com Tyco Integrated Security.................................... 68 tycois.com/lp Verisk Retail.......................................................... 53 veriskretail.com Wilson Safes......................................................... 61 wilsonsafe.com

LPM 0714-B.indd 64

off-price

jewelry/sporting goods furniture

music/books

❍ (G) Grocery/supermarket/

convenience store

❍ (H) Restaurant/hospitality/

entertainment

❍ (X) Other retailer_____________________ Non-Retail ❍ (N) Consulting/integrator ❍ (P) Product manufacturer ❍ (R) Services/outsourcing ❍ (S) Law enforcement/government/military ❍ (T) Education/library/media ❍ (Z) Other non-retail ________________ JULY - AUGUST 2014

associate manager

________________________________

Non-Retail ❍ (30) Vendor executive/owner/

manager

❍ (31) Consultant ❍ (32) S ales/marketing manager ❍ (33) P olice officer/active military ❍ (34) Educator/student/librarian ❍ (39) Other non-retail manager

________________________________ Fax to 714-226-9733

LPPORTAL.COM

7/22/14 10:24 AM

VENDOR SPONSORS

NATIONWIDE GUARD MANAGEMENT

VENDOR ADVISORY BOARD Agilence Pedro Ramos Vice President, Strategic Accounts

ClickIt Inc. Jim Paul Director of Sales

Intelligent Loss Prevention Jay Leedy Business Development Manager

Security Resources, Inc. Kris Vece Business Development

Alpha Diane Wise Global Marketing Manager

FireKing Security Group James Currey Senior Vice President, Cash Management Solutions

Milestone Systems Trenton Thoms Retail Sales Manager

Sysrepublic Christopher D'Amore Owner/Partner, Global Sales

Palmer, Reifler & Associates Jeff Welch Executive Director

Tyco Integrated Security Kevin E. Lynch, LPC Executive Director

Detex Ken Kuehler National Account Manager

Protos Security Patrick Henderson Vice President

Digilock Marcy Ream Vice President of Marketing

The Retail Equation Tom Rittman Vice President, Marketing

Universal Surveillance Systems Anthony Oliver Chief Marketing Officer Chief Technology Officer

InstaKey Security Systems Cita Doyle, LPQ Director of Sales & Marketing

Salient Systems Mary Wilbur Director of Marketing

Axis Communication Hedgie Bartol Business Development Manager, Retail Bass Security Paul Fisher Vice President, Sales & Marketing Checkpoint Carlos Perez Senior Director, Global Marketing

Corrective Education Company Darrell Huntsman CEO

LP MAGAZINE | JULY - AUGUST 2014

LPM 0714-B.indd 65

Verisk Retail David Duhaime President Verisk Crime Analytics

7/22/14 10:24 AM

PARTING WORDS

The Expert That Lives Within Each of Us H

Jim Lee, LPC Executive Editor

aving recently attended the NRF loss prevention conference in Fort Lauderdale, I found myself thinking about everything that it takes to put together this and similar events that support the industry every year. Having attended more than most, I’m granted the unique opportunity to reflect on all of the different events, how they’ve changed over the years, and how they’ve remained the same. It always amazes me to see the way that our industry has continued to evolve, and the effort and passion that goes into building a professional presence that effectively supports the retail business.

important that we don’t sit on our laurels, and we continue to work on our skills every day. I’ve found that the finest and most successful in our business are those that, despite their knowledge and experience, remain flexible and open-minded to new possibilities. I find it very revealing to see seasoned faces sitting on discussion panels at the conferences speaking on the newest technology. It reminds us why they’ve gotten to where they are. Especially considering the way that the retail machine is marching forward, this is an important part of our industry development.

Learning from the Best

There are experts in all walks of life—those with a high degree of skill in or knowledge of a particular subject. However, a true expert understands that expertise never fully reaches a pinnacle. A pro golfer may practice eight hours a day for years to become one of the best in the world. Shot after shot builds skill, confidence, accuracy, and muscle memory as their talent grows. But with all that talent and ability, even the very best have days where they just can’t seem to hit the ball. While anyone can shank a shot or misread a green, on any given day even the pros may just struggle to find their game. So what do they do? They stick with their game, they trust in their talent, they rely on their mechanics, and they move on. If all goes well, they play better the next day and the day after that. The same type of thing can happen to any of us in loss prevention. An LP expert works countless hours for years to craft his trade and become one of the best in the world. We build our talents with hard work, practice, cooperation, and dedication. However, regardless of how hard we work to hone our skill, there are still going to be days when we have difficulty finding our game. What should we do? Stick with our game, trust in our talent, rely on our mechanics, and move on. Sometimes we don’t give ourselves enough credit. Becoming an expert at what we do is something that we earn. Talent leads the way, but honing our skills and building a career is still a process. It’s not something that evaporates just because we’ve had a bad day. Remember that the best way to stay on top of our game is to consistently work on our mechanics. That comes through in our efforts to learn, listen, and share. Conferences, training, certification, and similar offerings provide us with that opportunity. Enjoy the ride, but take advantage of the opportunities.

But for me, it’s always been about the people. Some of my oldest and closest friends are part of this community, and I thoroughly enjoy the opportunity to see and meet with them at functions like this. With many there’s a familiar history, but there’s always room for common interests and new friendships. We may tell new stories and compare notes on old ones, but we’re still there to learn, share ideas, build our programs, and improve the business.

Becoming an expert at what we do is something that we earn. Talent leads the way, but honing our skills and building a career is still a process. Remember that the best way to stay on top of our game is to consistently work on our mechanics. It’s still fun to see the new faces that appear every year and watch as they absorb everything that goes on around them. It’s fun to watch the former rookies become veterans and take their game to another level. It’s exciting and energizing to see the maturation of our newest industry leaders and watch as they work with more experienced leadership to take the industry to another level. There’s always something new to talk about, and fresh ideas to lead the way. We have so many experts in this field, and a world of possibilities to expand our reach and influence. This also reminds us of the importance of developing the expert that lives in each one of us. Some are more apt at bringing it to the surface, while others have to work at it. But either way it’s equally

LPM 0714-B.indd 66

JULY - AUGUST 2014

Head Down, Eye on the Ball

LPPORTAL.COM

7/22/14 10:24 AM

Nationwide Security Guards and Investigative Solutions Solutions designed for loss prevention to protect your assets and lower shrink! • Emergency Response • Permanent and Temporary • Security Guards • Investigative Solutions

Proven Expertise

www.securityresources.net

(877) 477-9638 LPM 0714-B.indd 67

7/22/14 10:24 AM

We need to elevate our store performance

Customer expectations are higher – we have to up our game

LP can lead this conversation

Smart EAS, analytics and RFID improve our visibility LP technology does so much more now

The tech is smarter, which means better information

And better information means better customer experience

Industry roles are changing as fast as the technology is. We’ll help you think like a Chief Visibility Officer. From the big picture to a million minor details, your job is all about visibility. Creating a secure shopping environment. Managing loss prevention. Tracking millions of pieces of inventory – from the manufacturer to the shopping bag. And doing it all in one of the fastest-changing environments in global commerce. That’s why we like to think of people like you as Chief Visibility Officers – with an eye on every aspect of the industry, and the goal of improving customer experience through effective security practices backed by genuine Sensormatic® EAS technology. At Tyco Integrated Security, we get how important that is – and it’s why we work with 80 percent of the world’s Top 100 retailers on smarter ways to advance their business security. We’re more than a security company. We’re your Tyco Team.

To download our latest White Paper, visit TycoIS.com/LP 1.800.2.TYCO.IS / Safer. Smarter. Tyco.™ ©2014 Tyco. All rights reserved. Tyco and the product names listed above are marks and/or registered marks. Unauthorized use is strictly prohibited.

LPM 0714-B.indd TYCO-19336 Loss 68 Prevention July+August.indd 1

7/22/14 AM 6/23/14 10:24 2:14 PM

V13.4

MAGAZINE

BUILDING A NEW DEFENSE TEAM MANAGING THE RISKS ASSOCIATED WITH DATA SECURITY

LPPORTAL.COM