The skeptic

I read a story recently about the insecurity of wireless phone headsets. I was most surprised by the comments of a security expert who downplayed the concerns over these devices. In fact, the assessing team used the phones to record conversations, from which they created the “identity” of an employee from another office. They then used that identity to gain acces to the building, get a corporate ID badge/access card made (it allowed full building access), and were able to grab a desk in the building and connect directly to the corporate network. It seemed curious to think that this security expert would downplay the risk of these devices. Security is more than ROI and aligning with the business, even though those are the new buzz-phrases today experts are singing. Security isn’t about ROI or business alignment, although those are handy things to talk when it’s budget time. Rather, when it’s your job on the line, security is still about risks and threats.

-Geoff

 

Safety slugs in hospitals

I received a note based on a question about how to respond to shootings that happen inside hospitals in my weekly recap of the industry. The challenge, as we know, is that hospitals have a lot of mission-critical electronic (and chemical) systems plus a lot of people and are generally a very dense environment. They’re simply not the best places to shoot weapons to take down an active shooter (see incident from last week). One of our reader’s weighed in with his tip on the subject:

“I retired from the PA GAME COMMISSION after 36 years, (and two years as a Constable). As a Conservation Officer, I had several opportunities to dispatch small animals in a limited space. This was done with Glazer Safety Bullets. One of the calls I received was from the Warden of our County Jail. The jail is close to a small pond, and a muskrat from the pond had gotten in to the jail. The jail officials were afraid that the muskrat was rabid, and they wanted it removed. I shot it with a Glazer (in my 357 Magnum) and the bullet did not exit the muskrat. This was the case in all prior incidents were I had used a Glazer. Glazers expend all of their energy on the first object they hit, and go no further.  So my suggestion is “Arm Hospital Inside Security with Glazers”. – Bruce Carey, a locksmith from Pennsylvania

Interesting tip. Mr. Carey is actually referring to the Glaser Safety Slug, which behaves as he describes. The only warning some have issued is that these slugs, when used in handguns, sometimes don’t have the force needed to take down a perp. In rifles, that is not reported to be an issue. Share your thoughts here (use the comments button) or in our forums if you’d like to add more.

-Geoff

 

Police Post Photos of Shoplifting Suspects

Avondale, Arizona is posting the photos of suspected shoplifters on its website. Here’s the related article by Elias C. Arnold, a reporter from AZ Central.com.  The article states, ‘The photos, to be posted for about a month, name the suspects and their alleged targets, whether they have been convicted or not. Police envision the newly launched Web page as a tool for store workers to potentially connect unsolved thefts with a known suspect.”

Thus type of “cowboy justice” is not new to Arizona. Maricopa County Sheriff is famous for his methods for housing Maricopa County jail inmates.  Sheriff Joe Arpiao has housed inmates in tents, issued pink underwear, socks, bed sheets, and handcuffs when these items started disappearing. The problem was solved.

Kudos to the Avondale Police Department for thinking outside of the box.

Curtis Baillie - Security Consulting Strategies LLC

 

An interesting take on false alarms

I saw this article from The Alliston Herald (town of Alliston, in Ontario, Canada) about false alarms. The small business owner faced a break-in and didn’t have his alarm monitoring company call for police responders because he assumed it was a false alarm. He believed it was false because he had faced what he believed were two false alarms in the past few weeks. Now he suspsects that those recent false alarms — which occurred at about the same time as the real break-in — weren’t false at all, but were early attempts on the business and might have been used to case the store or to numb him to his alarm system. It gets murkier, because the business owner was concerned about being fined this most recent time if the alarm had proven to be “false”, like the previous alarm incidents at the business.

-Geoff

 

Shocker bracelet for aviation security

Now this is shocking news. In the wake of 9/11, a unique patent idea came up. The idea was for “a method of providing air travel security for passengers traveling via an aircraft comprises situating a remotely activatable electric shock device on each of the passengers in position to deliver a disabling electrical shock when activated.” So that’s the idea — a remote shocker bracelet, functioning somewhat like a Taser gun.

Not much has happened since the 2002 patent was issued for this bracelet, but now a company called Lamperd Less Lethal is proposing the ability to take such a bracelet to market, and the Feds have expressed some interest in using it as a prisoner control device (PDF file link). Lamperd has put for the idea of combining the shocker bracelet with a tracking device, so that air passengers could be linked to their bags and tracked through the airport, and possibly even that the device could serve as their flight ticket. Of course, at the root is the electro-muscular disruption (EMD) shocker circuit that could be used to stun and disable a would-be terrorist aboard a plane. Lamperd even has a promotional video about the EMD bracelet.

-Geoff

 

ASIS Seeking Public Comment on Preemployment Background Screening

The American Society for Industrial Security - International (ASIS) is seeking public comment on their Preemployment Background Screening guideline.  According to ASIS, The scope of the Preemployment Background Screening Guideline is to aid U.S. employers in understanding and implementing the fundamental concepts, methodologies, and related legal issues associated with  background screening of job applicants. (This guideline is focused on U.S. employers. The variables existing within the international community on preemployment background screening are not addressed in this guideline.)

If you are involved in any part of the background screening process you will want to read the guideline, and make comment to ASIS. This preemployment background screening guideline may very well become the standard used by the Courts in deciding litigation cases.

My only concern is the guideline fails to address post-employment background checks, which. I feel, should be an integral part of any companies screening process. I have voiced my concerns to ASIS. Here’s the public comment link. Comments will accepted through April 16, 2008.

Curtis Baillie, Principal Consultant - Security Consulting Strategies LLC

 

Hannaford Update

Class action lawsuits filed against Hannaford
Two class action lawsuits have been filed against Hannaford Bros.  since the company announced Monday that a data breach exposed more than 4.2 million debit and credit card numbers. The lawsuits were filed on behalf of consumers who say their debit or credit card numbers were put at risk. The Boston Globe/Associated Press

Curtis Baillie, Principal Consultant - Security Consulting Strategies LLC

 

DARPA’s robot toy

Where’s DARPA (Defense Advanced Research Projects Agency) money going? How about to this cool four-legged robot from Boston Dynamics? The video shows a robot with a payload greater than its own weight, and shows the BD team putting its through such tests as walking on ice, in snow, leaf-covered hillsides, piles of cinderblocks, dry creek beds, and more. The thing is just unbelievable, and shows one future vector of product development for defense and security. (P.S., if the YouTube video below is blocked, you can read up on the BigDog robot here, where there’s a link to download the video from Boston Dynamics’ site).  wmode=”transparent” width=”425″ height=”355″>Of interest is that this project builds upon more than 20 years of work. Boston Dynamics was founded by Marc Raibert, who prior to creating Boston Dynamics, was a professor at MIT in the “Leg Lab”, which was part of the Artificial Intelligence (AI) Lab at the school. As far back as 1986, Raibert was working on “legged robots that balance.”   — Geoff

 

Hannaford was PCI-Compliant During Data Breach

Follow-up….
‘Hannaford Bros. was compliant with the Payment Card Industry data-security standard when a security breach exposed about 4.2 million credit and debit card numbers, according to a Hannaford official. The company has been using data encryption since the start of last year and recently upgraded its wireless encryption capabilities, the official said.”

Here’s the story from: Digital Transactions

Curtis Baillie, Principal Consultant - Security Consulting Strategies LLC

 

Data Breach - Hannaford reports data breach involving 4.2 million accounts

Hannaford Brothers on Monday announced about 4.2 million credit and debit card numbers were exposed because of a security breach. Investigators said the breach has led to about 1,800 cases of fraud and has affected Hannaford stores in the Northeast, Sweetbay stores in Florida and a few other independent groceries. Hannaford said it has taken steps to enhance its network security capabilities and has warned its clients about suspicious transactions.

Credit - USA TODAY/Associated Press

Credit card fraud continues to soar. Many times it is due to the lack of security procedures of the retailer. I very recently had my own brush with credit card fraud. In my business I travel and frequently (every week) review my online credit card and bank statements. In Feb., 2008 I found where a gobal hotel chain charged two nights to my card when I had not stayed there. I did stay, for one night, back in November, 2007 and was correctly charged for my room and meals.

I contested the charge, called the local police, and notified my bank. Little did they know who they were messing with. Turns out an employee had dug out my old record and decided to charge the card and take cash from the register.

I tried several times to call the hotel and speak with the Manager, but was put off every time, he never returned any of my messages. Guess who took my money?

I guess the lesson of this story is to constantly check your statements and review the charges. I have friends that never check their statement and rely on the monthly bank statement as being accurate - pitty the fool.

Curtis Baillie - Principal Consultant  Security Consulting Strategies LLC