Reposted from Business Insurance

Recognizing warning signs and instituting reporting policies are key steps in preventing active shooter incidents in the workplace, according to a Risk and Insurance Management Society Inc. report.

Many workplace shootings involve employees, customers or someone related to the business, according to a RIMS report released on Monday. U.S. Bureau of Labor Statistics data showed that more than 20% of violent attacks in 2016 were carried out by individuals classified as people that employees likely recognized, with co-workers or work associates the assailants in 66 workplace homicide, students, patients, customers or clients responsible for 49 incidents, and relatives or domestic partners causing 43 incidents, according to the report.

“Assailants often exhibit certain warning signs before escalating to violence” such as poor work performance, unkempt appearance, frequent outbursts, unexplained absences and tardiness, and volatile and defamatory social media activity that employees must understand and recognize, the report said. “Distinguishing whether those incidents are isolated or part of a progression may make all the difference in identifying threats.”

The risk manager and human resources department should also establish a process where employees can safely and anonymously report threatening activity, regardless of the source, according to the report. And employees should be encouraged to alert human resources if they feel their spouse or domestic partner might intrude on the workplace either physically or through the internet or social media, according to the report.

Risk managers can develop active shooter preparedness plans that work best for their organization based on the size, location or scope and within a reasonable budget and timeframe, but should also test and practice the plans throughout the entire organization – effective testing methods include walkthroughs, tabletop exercises and planned or unplanned drills, the report said.

“An unplanned event is a bit more rooted in reality since participants will be forced to demonstrate what they know at a moment’s notice,” the report said. “And while this can be a great way to test employees’ reactions, there can be consequences as well. Operations may come to a halt and there’s always the chance that employees under duress may hinder progress.”

See Original Post

Reposted from Security Management

The U.S. Federal Emergency Management Agency’s (FEMA) operation in Puerto Rico after Hurricane Maria was the largest and longest response in the agency’s history. 

Yet, as it had been with its responses to Hurricanes Katrina and Sandy, FEMA was widely criticized for how it handled the disaster, which caused more than $100 billion in damages to the island and killed possibly thousands of people.

There were numerous factors that could have influenced this response. A U.S. Government Accountability Office (GAO) report found that 54 percent of federal emergency personnel were not qualified for the positions they held in October 2017—a month after Hurricane Maria made landfall. This challenge was echoed after Hurricane Katrina as well, largely due to differences between federal hiring processes that emphasize administrative background and education versus those in many state and local emergency management departments that recruit heavily from the fire, law enforcement, and emergency communications services. 

FEMA also faced numerous challenges that “complicated response efforts,” the GAO said. These challenges included the timing and overlapping of three major hurricanes that caused staffing shortages and logistical challenges that complicated efforts to deploy resources and personnel quickly. 

They also included the overall limited preparedness of the U.S. Virgin Islands and Puerto Rico for a Category 5 hurricane and the “incapacitation of local response functions due to widespread devastation and loss of power and communications,” the GAO explained.  

FEMA “essentially served as the first responder in the early response efforts in Puerto Rico,” the GAO found. “FEMA officials said that many services provided—such as power restoration, debris removal, and commodity distribution—are typically provided by territorial or local governments.” 

This again highlighted a major lesson learned in the governmental response in New Orleans when planning and infrastructure deficiencies at the local level hindered the federal government’s ability to provide effective support and logistics.

Furthermore, FEMA and other U.S. government agencies also faced challenges in getting personnel on the ground in Puerto Rico to respond to the hurricane because of limitations on air travel and power outages. Instead of using commercial travel, FEMA had to rely on agency partners to provide chartered air transportation.

The GAO’s analysis also found that while officials from Puerto Rico and U.S. Virgin Islands had engaged in disaster preparedness exercises before Hurricane Maria, they had not experienced or stored the resources that would be necessary to respond to a hurricane of its strength. “Specifically, Puerto Rico officials had not considered that a hurricane would cause a loss of power for as long as Hurricane Maria did,” the report said. 

The challenges revealed by the response to Hurricane Maria highlight one major concern with emergency management disciplines—that they vary from place to place. Issues arise when the plans, capabilities, and management of the state and local partners receiving emergency management assistance are thwarted by operational issues that may create obstacles to disaster prevention, mitigation, or recovery. 

The Role of FEMA

Since 1803, the role of emergency management has morphed from an act of the U.S. Congress requiring that it provide financial assistance to local jurisdictions following disasters to civil defense functions to the current all-hazards approach to continuity of government and disaster recovery. 

While the validity of the function of emergency management has never fallen into question, the landscape has changed with the addition of terrorist and active shooter incident mitigation to the already prevalent natural disasters officials plan for, mitigate, and recover from. Emergency managers are responsible for planning for worst-case scenarios. 

With FEMA, the U.S. federal government’s ultimate obligation is to help state, local, or individual entities with funding, equipment, and manpower support in overwhelming circumstances. Emergency managers in the private and nongovernmental sector are responsible for the safety of their assets and continuity of essential operations. 

Staffing—and even the existence of offices of emergency management—within state and local government agencies, critical infrastructure, education, and business vary widely depending on the area and the scope of the organization. 

The role of emergency management has traditionally been defined as a planning and support mechanism for dealing with risk—and risk avoidance—from a broad range of situations. These professionals were normally tasked with disaster planning, emergency communications, command center operations, and obtaining funding for mitigation and recovery.

Emergency managers have had closer relationships with fire services in the past than with the security and law enforcement communities. However, emergency management is integral to the security of organizations, and its integration with the security planning and response landscape is vital to its roles in response to recent major disasters.

To address this area of vulnerability with FEMA, U.S. President Donald Trump appointed Brock Long as FEMA administrator. Before being placed at FEMA, Long worked for the Georgia Emergency Management Agency and was Alabama’s state emergency manager. 

The appointment of a career emergency manager marks a departure from prior administrations who typically appointed administrators with no prior experience in disaster management. FEMA is also addressing how it hires, trains, and retains staff to ensure that it is prepared to respond to disasters that may occur simultaneously.

With FEMA revamping its operations and staffing up in response to the latest hurricane season; it is imperative for state, local, and private emergency management to do the same. Many emergency managers outside of the U.S. federal government—and larger states and cities—perform basic business continuity planning to ensure incident survival. 

Assessment

Consideration of security threats is essential to the operational survival of local jurisdictions, businesses, and nongovernmental organizations. Therefore, emergency management must expand its current planning, response, and recovery operations to include security threats to ensure the physical safety of first responders and stakeholders. 

Organizations should create emergency management functions within security management roles. Jurisdictions that already have emergency managers can also assess current operations and seek to create preincident working relationships with law enforcement and security agencies. These emergency managers are normally the incident commanders during man-made disasters, like terrorist attacks, until such time as the FBI or law enforcement takes over. 

An example of this on the U.S. federal level was illustrated when former President George W. Bush signed the Homeland Security Act of 2002 into law, creating the U.S. Department of Homeland Security (DHS). The act charged the new cabinet-level agency with the mission of protecting the United States from terrorist attacks and minimizing the damage from attacks and disasters. This act incorporated FEMA into DHS. 

Teamwork

To ensure that security management and emergency management are working together, the author organized three roles into one directorate while serving as a director for North America’s largest medical board: chief security officer, head of investigations, and emergency manager. This configuration allowed the security department to work with cross-functional staff to create policies, procedures, and countermeasures that would allow the organization to protect its human, physical, and intellectual assets in an efficient way that addressed both emergency mitigation and security threats. 

Assuring that emergency management coordinates effectively with all facets of public safety is a key function of mitigation. This differs from other emergency management disciplines in that it presents long-term solutions to reducing risk, instead of accepting that risks exist and preparing, responding to, or recovering from their eventuality. 

However, mitigation involves coordination across a wide spectrum of public and private sector stakeholders. For instance, New Orleans officials hampered evacuation efforts after Hurricane Katrina by parking its fleet of buses in a lot susceptible to flooding—which delayed evacuation procedures until a new fleet could be sourced.

In the wake of Hurricane Maria, FEMA conducted its own after-action report—in addition to the GAO analysis—and is making changes to address security planning and mitigation to address the shortcomings of the response in Puerto Rico. 

“FEMA…made improvements in staffing for incidents, logistics operations, and refining communications from land mobile radios to satellite communications,” wrote Jim H. Crumpacker, CIA, CFE, director of departmental GAO-OIG Liaison Office for DHS in its response to the GAO report. “Finally, FEMA has updated high priority national level contracts to be better prepared to cope with responding to multiple concurrent disasters across the nation.”

Additionally, FEMA incorporated objectives in its 2018 to 2022 strategic plan, including improving readiness of incident workforce cadres; building staff, equipment, and contract capacity; and streamlining the disaster survivor and grantee experience. 

“Disaster can strike at any time and in any place, building slowly, or occurring suddenly without warning,” Crumpacker wrote. “FEMA is part of a larger team of federal agencies, state, local, tribal, and territorial governments, and nongovernmental stakeholders that share responsibility for emergency management and national preparedness.” 

Those in charge of security for a particular location need to cross-plan for natural disasters and environmental threats. They also need to factor in the probable response by their federal, state, and local partners. 

Just as threats like active shooters, unpermitted protests, and flash mobs have changed the face of security management, security threats have changed the face of emergency management. It’s incumbent upon security and emergency management professionals to work together before an incident to plan and assess their threats accordingly.  

HOW TO DIAGNOSE YOUR EMERGENCY MANAGEMENT CAPABILITIES

An Evaluation of Emergency Management Capabilities Begins with Questions Such as:

• If a local jurisdiction is growing exponentially, is the state of its local emergency management planning addressing that growth and forecasting worst-case scenario needs?
  

• If a transit agency’s emergency plans rely on local emergency management capabilities, does the local team have an independent office of emergency management that can weigh its geographic footprint in areas that may have minimal first responder capabilities?
  

• Does a private sector organization include the principles of professional corporate security and emergency management in its business continuity planning?
  

• If the organization relies on public sector stakeholders in emergency management, has it evaluated the effectiveness and track record of their plans and performance when conducting internal emergency management planning?
  

​These questions are critical because private organizations face some of the same challenges as government agencies when addressing emergency management. For instance, medical board administrators secure examinations that have copyrighted trade secrets; the workplace is secured in a similar manner to government offices where classified information is stored. During an emergency, such as a fire, a conflict could arise between security policy and local laws requiring access doors to automatically unlock—enabling people to evacuate the building but also providing access to criminals to steal from the facility. ​

See Original Post

Reposted from Hurriyet Daily News

Algeria's oldest museum, home to some of the country's most valuable art, was vandalized during protests against President Abdelaziz Bouteflika's bid for a fifth term, the culture ministry said on March 9.

"Criminals" took advantage of thousands-strong demonstrations on March 8 to break into the National Museum of Antiquities and Islamic Arts in Algiers, founded in 1897, the ministry said in a statement.

"Part of the museum was ransacked, objects stolen and administrative offices burned, as well as documents and records being destroyed," the ministry said.

Firefighters arrived promptly and prevented the blaze from spreading, while police had managed to retrieve a sabre dating from the time of the Algerian resistance to the French conquest of Algeria in the early 19th century, it said.

Tens of thousands protested across Algeria on March 8 in the biggest rallies yet against ailing Bouteflika's bid for a fifth term in April polls.

The police fired tear gas and stun grenades to disperse those who tried to force their way through a police cordon, but most demonstrators dispersed calmly as darkness fell.

The ministry called the acts at the museum "a crime against a historical heritage that covers several important stages of Algerian popular history".

Founded during the French occupation of Algeria, which lasted from 1830 to 1962, the museum is one of the oldest in Africa and covers over 2,500 years of history and art.

Police had not yet identified those responsible, the ministry said, adding that security had been reinforced on March 9 and that "criminals" had already attempted to enter the site during a previous protest on March 1.

The museum lies at a major crossroads close to the presidential palace in Algiers.

The junction was the scene of clashes on March 8 between young protesters and police, while demonstrations elsewhere in the city passed off in relative calm.

See Original Post

Reposted from Allied Universal

Quality security providers see great value in employee engagement. Not only is it the right thing to do, but better engaged security officers provide better service. Should engagement efforts end there? Or, does the organization contracting the services play a role? 

In my experience, the most successful engagement programs involve efforts by the security provider and their client. Leading security programs are based on a partnership that fully integrates security teams. This includes everything from committee participation to communication. While the security provider leads the engagement process, the client or end user should participate as well.

These often heard responses present an opportunity to challenge the status quo:

I Need to Focus on My Own Business

There is no doubt that you’re very busy, but imagine if a security contractor could help enhance your company’s brand. Security officers may not be your employees, but they represent you. For most leaders, that’s a large part of ‘focusing on your own business.’ Whether that includes a customer-oriented environment, the perception of safety and security, or both, security officers play an essential role. Their engagement leads to a vested interest in your success.

That is the Contractor’s Job

Establishing the vision for your security program means understanding the importance of choosing a partner that provides value and aligns with your established direction. This requires an accountable contractor with engaged employees at every level. However, contractors know that their most involved teams are located at sites with an established and engaging culture.

What Can You Do to Help?

• Speak with the security officers: We all want to be known, understood and appreciated. A daily greeting or quick conversation will go a long way toward continued engagement.

• Remind them of their value: We also need to be reminded of our value. You can help by connecting the team’s everyday work to the lives they are impacting.

• Make measurements visible: What key performance indicators do you use for security? Occasionally, share some data with the security officers. Visualizing their contribution adds to engagement.

If you are considering a change in your security program, access Allied Universal's Guide to Contracting Security.

See Original Post

Reposted from Springfield News-Leader

By 1985, when the Springfield Art Museum received a donation of 10 Andy Warhol Campbell's Soup screenprints, the artist himself was more interested in making TV shows and movies than Pop prints and paintings.

If someone made a movie about the night seven of those screenprints were stolen, the establishing shots would be all about routine.

The museum boasted multiple levels of security: Guards. Locks. Alarms. Video.

At the time of the 2016 theft, staff had begun updating the emergency plan for the first time in years.

In the early hours of April 7, the museum's alarms were active. Video surveillance captured the darkened, quiet galleries. At closing time, a guard checked the museum's locks.

Roger Hall usually had that task. A security guard since 1981, he had worked at the art museum since 2002.

Hall and a colleague, former Chicago Police Department officer Martin Daniels, who was hired in 2015, patrolled the museum and its grounds during open hours. They had help from part-time guards.

After dark, the museum was not patrolled by guards, but secured by the locks, the video, the alarms.

The alarms were monitored by a company that had been under contract for many years, Atlas Security.

Four months after the prints were stolen, the city's insurance company sent investigators from New York City to Springfield. They wanted to understand what happened, to determine whether the insurer should pay a claim for the Warhol loss, and if so, how much.

Hall told the insurance company he was usually the last employee to leave at night, and the last to get there each morning.

He and his fellow security guard were two of four museum employees interviewed by lawyers for the insurance company. The others were the museum director, Nick Nelson, and the curator of art, Sarah Buhr.

The insurance company’s investigation is separate from investigations by law enforcement. Sworn statements made by museum staff, and accompanying documents, were reviewed by the News-Leader after the city released the documents late last year in response to a Sunshine Law request.

Citing exemptions in the law, the city redacted parts of the insurance interview transcripts because they discussed security matters, an investigative report and human-resources issues.

The city released one version of the statements Nov. 27, with heavy redactions. After a Jan. 24 interview by the News-Leader with the museum director and the city’s chief public information officer, city officials chose to release the statements a second time, with many fewer redactions: 88 pages were updated, out of more than 280 pages in the document bundle.

In a Jan. 28 email, City Attorney Rhonda Lewsader said, "City staff in conjunction with the police department determined that some of the information initially deemed likely to jeopardize a criminal investigation could be released."

Even partly redacted, the transcripts reveal a close-up view of what happened in the hours before and after the Warhol theft.

On April 7, 2016, the day the theft was discovered, Hall rolled in at 8:30 a.m. The museum opened to the public a half-hour later.

Buhr, the curator, was already at work. She joined the museum 11 years ago and was responsible for dreaming up, researching and implementing new exhibits.

Exhibits, often incorporating art on loan as well as pieces from Springfield's collection, make up the core of the art museum’s mission: to preserve beautiful and significant objects forever, while showing them off in ways that inspire and deliver knowledge to as many people in the community as possible.

To do this work, Buhr starts her day early. She told the investigators she usually gets to her desk at 7:30 a.m.

An hour later, she went to a regular staff meeting. The museum’s fifth director, Nelson, presided. There was a daily to-do list, and the team went over it — all the while unaware, Hall told the investigators, that seven of the Warhols were gone.

The curators, the education staff, the communications officer and the security guards were all in the meeting. Only Luz Melendez, the receptionist, was not present.

Melendez had to stay out front, due to a big event going on that day.

Louise Knauer, chief operating officer of Community Foundation of the Ozarks, said she and 100 other people from Springfield’s nonprofit world came to the museum that morning to use the auditorium for a training session. They were getting ready for that year’s Give Ozarks, an online fundraising drive.

The museum has been accommodating more and more big events in recent years, the idea being to bring new people through the doors.

The strategy has been bearing fruit. The visitor number has climbed 75 percent since 2012, when Nelson started as director. In 2016, the taxpayer-funded museum was on track to see some 52,000 people come through the doors. Attendance currently stands at more than 60,000 people per year and continues to grow.

Knauer can’t remember the exact time she got to the museum that morning for the  training. She said it was before opening hour, because she and her crew had to come early to set up a check-in table in the museum lobby.

The scene of the crime was not far away. From the lobby, a long hallway known as the King Gallery takes visitors to the center of the museum campus. At the east end of the hallway, a glass wall with double doors fronts a courtyard built in 1960, two years after the art museum’s Original Wing was completed.

The courtyard is open to the sky and has a gleaming, leaf-shaped fountain. Through a metal gate that’s padlocked overnight, the space opens to the outside. There’s a sidewalk, a narrow concrete bridge that jumps the Phelps Grove creek, then the street.

As visitors go from lobby to courtyard, they pass three sets of big doors on the south side of the hallway. These lead to three more galleries, all added in 2008.

The middle room, called the Spratlen Gallery, was where the soup cans hung — from nails, rather than more expensive secure-hanger technology sometimes used.

Springfield’s “Campbell’s Soup 1” set hadn’t been seen since 2006, but curator Buhr put the soup cans in “The Electric Garden of our Minds,” a dazzling show of American and British pop art.

The 2016 show also included a treat from the museum’s vaults: prints by the Scottish artist Eduardo Paolozzi, considered the father of British pop art.

A private collector gave the Paolozzis to the museum in 1981, four years before The Greenberg Gallery in St. Louis donated the Warhol prints.

But for 35 years, the Paolozzis, colorful and intellectual in a way that contrasted with the Warhols’ embrace of pure commercial imagery, had never been shown to the public that owned them.

They had recently been rediscovered in the museum’s vaults, which did not have what its director called a “good inventory” until 2015, according to one of the sworn statements he made to insurance investigators.

“We get asked that a lot,” Nelson said when he was interviewed by an investigator a few days after the theft. “Has this ever been shown? ‘Cause we have a bit of a reputation for holding art and never exhibiting it. So we try to say, well, yeah, we, you know, we’re bringing this out of the vault to show you.”

Nelson was not the first Springfield museum director to work on storage and inventory. His predecessor, a Vietnam veteran from Wyoming named Jerry Berger, added more and better storage space in 1994, when the Jeanette L. Musgrave Wing went up on the east side of the building.

The addition cost at least $2 million in today’s dollars, the News-Leader reported at the time, including today’s equivalent of $170,000 for special storage racks needed to keep wall art safely. Much of the funding came from private sources.

Nelson later described the resource-intensive challenge of museum inventory in this way: “Imagine if I gave you 10,000 M&Ms and said I’m going to come back in 10 years, and you need to know where all the M&Ms are, and I want them to be in the same condition they were when I gave them to you 10 years ago.”

Since Nelson took over as director in 2012, museum officials had installed new software to track Springfield’s collection of roughly 10,000 art objects. The application, PastPerfect, allowed the museum to publish an online catalog for the first time, something commonplace at big urban museums.

But conservation of the art had always been good, in Nelson’s view. And everything was guarded, under lock and key, and the building had alarms.

In spring 2016, those weren’t issues that members of the public were thinking about.

As she got ready for the Give Ozarks event, for example, Knauer didn’t get anywhere near a Warhol. She was busy, and the galleries were closed during her set-up time.

She helped send nonprofit communications people to the museum’s 392-seat auditorium, a mid-'70s legacy of the museum’s second director. He had also been trying to get new people through the museum doors.

And in another room, the museum staff meeting was going on. It took about 15 to 20 minutes, Hall told the investigators.

Less expensive than 'kid painter' work

Very soon after the meeting, museum staff discovered seven of Springfield’s Warhols had been stolen.

The theft made news across the world, largely due to the enduring power of Warhol’s name, three decades after his death on Feb. 22, 1987.

Even rarefied Warhol experts had something to say about Springfield.

In the days after the theft, a Warhol biographer in New York, Blake Gopnik, cranked out a hot take.

On Artnet News, Gopnik noted that the value of the Springfield screenprints was relatively minor. He pegged them as worth $30,000 each, at most $500,000 for the set. (Ultimately, Springfield’s insurance payment totaled $750,000.)

“They cost less than you might pay for a piece of zombie abstraction by some kid painter fresh out of grad school,” Gopnik sniffed.

In part, that’s because in 1968, Warhol ordered 250 sets from the printer. Many of the fragile prints have deteriorated over time. Only about 50 sets of “Campbell’s Soup 1” remain complete and in good condition, a Los Angeles Warhol gallery owner told the New York Times five days after the theft. Springfield owned Set 31.

In contrast, the polymer-on-canvas paintings of "32 Campbell’s Soup Cans" that Warhol created in the early '60s were one-of-a-kind and far more valuable. Each of the 32 paintings, Gopnik wrote, might fetch “something like $10 million” on the art market.

The later prints were a less costly kind of art more within the reach of a museum like Springfield’s.

Since 1947, acquiring prints had been a strategy to broaden Springfield’s art collection. Donors, like the Greenberg family in St. Louis, might be persuaded to part with them — and Berger, the former director, was famously good at cultivating donors — especially if they were part of a big print run, like the Warhols.

The museum still has a hankering for prints. Last year, it added a late-period Picasso linocut portraying a woman in profile. A similar one sold at Sotheby's in London for $29,000.

It was about 8:50 a.m. when the staff meeting broke up. Just before the museum’s 9 a.m. opening, security guard Hall went to the front desk to watch video feeds from the galleries.

Pretty soon, Hall saw something missing. Where there should have been 10 Warhol soup can prints hanging, there were now only three: "Consommé (Beef)," "Pepper Pot" and "Cream of Mushroom."

“I noticed the blank spot on the wall,” Hall later told the insurance company lawyer, “and I was the first one to notice that.”

“So you notice that something is seriously wrong, or potentially seriously wrong,” the lawyer replied.

The attorney's name was Dennis Wade. His New York law firm is located a few blocks from the rebuilt World Trade Center. Four months after the theft, insurance company StarNet sent him to Missouri to interview museum officials about the Warhol theft.

In a conference room at a downtown Springfield law firm, he questioned Hall and another security guard, Daniels, along with director Nelson and curator Buhr. The city sent one of its staff attorneys and a private lawyer with the museum employees.

“Because where once there were soup cans,” Wade asked, “there are no soup cans, correct?”

“Correct,” answered Hall, according to the transcript of his statement.

Not long after Hall saw the blank spot on the wall in the video feed, his fellow guard Daniels approached him at their perch in the lobby.

“I think there’s something suspicious down here at the courtyard door,” Daniels told Hall.

Daniels later told investigators that he had noticed a “Do Not Enter” sign placed between the two glass doors leading to the courtyard.

The two walked down the King Gallery to the glass doors. Together, they made a second discovery.

“We looked at the door,” Hall told the insurance company lawyer. “And there seemed to be a piece of Cyprus (sic) mulch-type stuff stuck inside of the hole in the lock, so I went straight to (museum director Nelson) and reported that to him, and he came and looked at it, and he asked me to go and call (Atlas Security, the museum’s alarm company) to see if they had gotten any sort of alarms in that area the previous night.”

Later, Nelson told the insurance company that it appeared that the door had been tampered with “during open hours and people came back afterwards.”

To anyone checking from the interior, the door appeared locked.

“But when you came on the exterior and you really yanked it, it just came right open,” Nelson later said.

After Hall and Daniels discovered the mulch, Hall called Atlas.

“I was on the line with them for quite a while, while they checked that out,” Hall told the investigators.

Atlas told Hall that there had been alarm activity the night before. Three successive alarm pings went off, according to the interview transcripts, although the redactions leave it unclear what type of alarms they were.

“I believe they told me that was around 12:20 or so in the morning,” Hall told investigators.

While Hall was on the phone with Atlas, Cindy Quayle, exhibitions manager at the museum since 2008, approached him.

Hall asked Quayle why some of the Campbell’s Soup cans had been taken down.

She answered that they had not been taken down.

“That was when I realized we’d had a robbery,” Hall told investigators. It was just before 10 a.m. The museum had been open for almost an hour.

Hall got off the phone with Atlas. He and Daniels went to Nelson.

“I was in a meeting,” Nelson told investigator Andy Quested on April 11, 2016, four days after the theft was discovered.

Originally from England, Quested is an insurance adjuster who once worked for Lloyd’s of London. Based in the New York City area, he has experience in jewelry and fine arts insurance and in claims resulting from the terror attacks of Sept. 11, 2001.

The security guards came in and said, "Hey, we need to talk to you about something, an incident,” Nelson continued. “I mean, that’s when I went out.”

After Hall and Daniels told the museum director of their suspicions about the courtyard door, staff "immediately” went into museum procedures for missing or stolen art.

Nelson said they “closed the gallery, moved everybody out, secured the door, all that.”

Nelson told Hall to call the police. The call came in at 10:03 a.m., according to the police report.

Nelson then went to Buhr, the curator. Together, they went out to the galleries.

“We were still open,” Buhr told investigators. “So I asked the guards to help me close the galleries so that the area would be devoid of people, and then we sort of stood around waiting for the police to come.”

Buhr said she talked to one of the security guards, Daniels, as they stood in a gallery doorway. She asked why the police hadn’t responded overnight, at the time of the theft, and why staff hadn’t been called. Later, she asked Nelson.

“I asked that question that day and I was never really given a clear answer as to why they did not come,” she told investigators.

Nelson told her, “I’m not quite sure what happened yet.”

“Things were still happening,” Buhr later said.

It was a busy morning. A hundred nonprofit workers had streamed through the lobby for their training session. One of them, the executive director of Missouri Safe & Sober, tweeted a photo from inside the auditorium at 10:10 a.m. She told the News-Leader she can’t remember noticing anything amiss that morning.

Knauer, COO of the group that put on the training, doesn’t recall much more, nor did two other nonprofit workers where were there.

“As we were getting ready to wrap up," Knauer said Feb. 11, "I noticed a heightened sense of distraction, maybe. Like the museum folks were getting called away, or kind of having to divert their attention.”

“We had no clue as to what was going on,” Knauer added. “We got done around noon, left, and later when that news broke, it was like, oh my god, we were there.”

So why did confusion reign the morning after the theft?

“I don’t know how people didn’t see (the Warhols) missing," Nelson said four days after the theft. "Or maybe they saw them missing and didn’t — and thought maybe somebody had them or… Anyway, there was a failure there. As soon as we saw them missing (the next few words of the transcript were redacted by city officials) it should have been initiated, that response.”

Referring to security footage, Nelson added, “You could see it all play out. You could see security guards coming together talking, exhibition manager coming and talking to the security guards, them walking back and forth, back and forth, back and forth, then finally I come out and then I go get the curator, then we come back and then you see a bunch of visitors moving out of the gallery.”

What wasn't yet clear was why neither Nelson nor police got a call from the alarm company when the break-in occurred.

That, it turns out, was a self-inflicted mistake.

A lot of things have changed at the museum since the theft.

In the wake of the Warhol incident, the museum board — appointed by Springfield’s city manager — went into at least two closed sessions to discuss security upgrades. They bought new technology, the nature of which has not been made public because the city does not want to compromise its own deterrents.

The museum hired more guards as well as new gallery attendants.

In 2018, after decades of discussing and sometimes pursuing the goal, Springfield’s art museum also achieved accreditation from the American Alliance of Museums. Security standards are part of the requirements. Only about 3 percent of U.S. museums are accredited.

Nelson, in an interview with the News-Leader, used the phrase “robust system” three times to describe the museum’s current security setup.

But three years ago, that journey still lay ahead of the museum’s staff and its city oversight board.

Because that morning, everyone was still trying to figure out what the heck happened.

When he learned of the theft, Nelson asked staff to check the galleries and the vaults. According to the insurance company transcripts, each area of the vaults contains a sheet listing all the artwork stored in that area, allowing for a quick visual check.

Staff soon found that no other art had been stolen.

A half-hour after a security guard called police, he called police again. But an officer didn’t arrive at the museum until 12:51 p.m., almost three hours after the initial call, according to police records.

Police officials say they prioritized the art museum theft as they would any other crime. It was a commercial burglary that had already happened, so it was Priority 3, less urgent than a violent crime in progress.

Springfield Art Museum had joined a club of burglarized museums as varied as the Louvre (the "Mona Lisa" was stolen in 1911, then recovered a couple of years later) to the Ralph Foster Museum at College of the Ozarks (which experienced theft of a set of 76 Japanese coins in 1980 that, according to News-Leader archives, were valued at the equivalent of $3 million in today's money).

The criminal investigation began, which would involve Springfield police, the FBI and an alert to Interpol.

Officer Steven Layton’s police report, printed late on April 8, 2016, is mostly redacted, but it lists property involved in the crime, including the stolen art.

Police took impression castings of pry marks on the courtyard door.

They took into evidence the emergency exit sign that had been stuck between the doors, and the wood chip inside the courtyard door’s striker plate. Investigators also found scratches on the door, according to the guards' statements.

Police also took a white sticker and a latent print of some kind. The redacted police report doesn’t make clear whether it was a fingerprint or some other type of impression.

They also started trying to figure out why they weren’t alerted until many hours after the theft happened.

The narrative of the crime itself, as far as it can be gleaned from sworn statements the museum gave to the insurance company, began to emerge.

At some point overnight, late on April 6 or early on April 7, the “bad guys,” as the insurance company lawyer described them, showed up at the museum.

The museum director and the city spokeswoman told the News-Leader that the surveillance video was too dark to determine whether just one person, or more, committed the theft.

Whoever did it, they appear to have “somehow vaulted or otherwise got over the wrought-iron fence just outside the courtyard,” in the words of the insurance company lawyer.

Then they went to the courtyard door, likely pried it open, went through the King Gallery, then entered the Spratlen Gallery, with the Warhols inside.

The wood chip and the emergency exit sign likely kept the courtyard door open while they nabbed the seven prints, making multiple trips, according to statements by Nelson.

They likely passed the skinny framed Warhols through the bars of the metal gate, which are only a few inches apart.

They were only inside the museum four minutes, from entrance to exit, according to the museum director and the city’s chief public information officer, who confirmed that information for the first time in late January.

Also for the first time, officials acknowledged that an alarm did sound during the theft. But neither police nor museum officials were alerted.

“It did go off when they came in,” security guard Daniels told the insurance investigators.

“So why didn’t the police come?” the lawyer asked. “Why didn’t the museum get called?”

The 20-year Chicago police veteran answered, “I don’t know. I’ve asked that question to myself because every burglar alarm I’ve ever been to, police came and somebody came. I know I went to hundreds of them.”

He asked about it the day the theft was discovered, but nobody could give him a clear answer. Later, Daniels learned about a “code” placed on the art museum’s file with Atlas Security.

Other staff learned about it, too.

Buhr, the curator, told investigators, “I was later told that there was some sort of fault in the alarm system. That there was some weird code on one of the doors.”

That afternoon, Nelson and Springfield police called Atlas Security on speakerphone to go over a long printout detailing alarm activity.

The insurance company lawyer described it as the “what the heck happened” call.

City officials are willing to talk about that “weird code,” but only in general terms, and the parts of the five sworn statements that discuss the code are often redacted.

The code was a note placed by Atlas Security on the museum’s account file more than a year before the Warhol theft. Nelson called it “a standing order with the alarm company” that he gave about how to handle alarms, and when to contact him and the police.

The museum made the instructions while handling a case of “numerous false alarms” in February 2015.

Over several days — Nelson couldn’t recall whether it was a week or a weekend — Nelson got calls from the alarm company at odd hours, sending him to the museum in the middle of the night.

“I don’t recall what piece of equipment it was, that malfunctioned,” Nelson said in a partly redacted portion of one of his sworn statements.

The equipment failure, he later told the News-Leader, was “sending in a report of activity at the museum” when the museum was closed and possibly at other times.

“It was just unreliability,” said Cora Scott, the city public information officer.

So Nelson put in a service call to the alarm company.

“We were going to have work done on it,” he said. “As we were working through this, correcting the system and making these repairs, at one point there was a notation made to — if those alarms didn’t meet a certain ..."

“If X, Y, and Z didn’t happen,” interjected Scott.

“Then to not dispatch,” Nelson resumed. “’Cause it would be safe to assume it was an incorrect alarm, or an alarm that was not a legitimate incident. For whatever reason, that notation was not removed from the account after the problem had been solved. Again, I don’t recall why or how that mistake happened.”

He added, "If you fast forward to the (Warhol) incident because of some other issues with the way the alarm was set up at the time, the, those qualifications weren’t met and there was no dispatch.”

When Nelson learned about the note's role on the night of the theft, he “immediately nullified" it, he told investigators.

The insurance company had many questions about all this — the status of the city's claim depended on the answers.

Wade, the lawyer from New York, closely questioned Nelson about his understanding of the alarm system, both in Springfield and at his old job in southern Georgia.

The security guards were questioned. Daniels, hired seven months after the alarm issues happened and the note went on the file, told investigators he was never aware of any false alarms.

Hall, a guard since 2002, said he had been aware of issues such as mobile art turning in the air in a way that could set off alarms, but not of the note.

The lawyer asked if Hall learned about the note on the day of the discovery or “as people were investigating.”

He answered, “I did not become aware of that fact until the FBI was interviewing me and Mr. Nelson was in the room and they asked him that question.”

Museum thefts are often committed by people with close ties to museums, so the insurance company’s investigators also asked about current and former museum staff.

Nelson told the News-Leader, “From what I understand, most art theft in environments like this, a lot of times, are inside jobs.”

Talking to staff is “the obvious place to start if you’re investigating this,” he said.

He conceded that the Warhol theft and the investigation harmed museum staff morale.

“I don’t think it would be overly dramatic to say people were heartbroken,” Nelson said, comparing the situation to the aftermath of a home break-in. “Not to speak for anybody, but I think it’s fair to say they felt violated, they felt unsafe, probably, in their own workplace.”

Investigators questioned Buhr, the curator, about a series of text messages she exchanged with the museum’s former assistant director, Merritt Giles, whose responsibilities included security. About five days after the theft, Giles texted Buhr a reference to “The Thomas Crown Affair,” a movie about a fictional art theft.

Buhr did not immediately respond. When she did, she sent Giles a photo of flowers growing in the museum courtyard. While he’d been at the museum — 2013 to 2015 — Giles had put new plants and outdoor furniture in the space.

They began texting back and forth about the courtyard fountain. It hadn’t been cleaned lately because the area was closed off for roof repairs.

“Plus we’ve been a little distracted lately (sad emoji),” Buhr texted.

“Yeah, how is that?!?” Giles responded. “I’ve been getting texts galore about it.”

“It’s insane,” Buhr texted back. “I’m so angry I can barely walk in the door each day. Who keeps texting?”

They talked about "numerous SGF" people who were texting, and about Jimmy Fallon joking about the crime on late-night TV.

Giles texted, “It’s not the publicity you guys wanted, but it is publicity … you know the old saying. It just seemed crazy that it even happened.”

He added, “I bet Nick is adding the security system and camera updates to the list now, despite his saying it wasn’t needed when I approached him about it a year ago.”

Contacted by the News-Leader last week, Giles, who now lives in southern Georgia, said he had been unaware that his name came up in the insurance company documents until being asked about it by a reporter.

Noting that he left the museum six months before the Warhols were stolen, Giles wouldn’t comment on any security suggestions he made while he worked at the museum, or whether he knew about the problems with false alarms. (Nelson told investigators he could not recall whether he had discussed the false alarm issue with Giles. Security guards said they didn’t know what kinds of security matters were discussed between the two.)

Giles said the FBI had not contacted him as part of its investigation.

“I wouldn’t see why they would contact me,” Giles told the News-Leader last week. “Again, I wasn’t working there at the time.”

Another man with indirect ties to the museum came up in Buhr’s statement to the insurance company.

Clarence Brewer is a Springfield painter, sculptor and blues musician who performs as King Clarentz.

He told the News-Leader that the FBI has not contacted him about a phone call that Nelson described to investigators as “weird.”

Buhr, the curator, got to know Brewer because she keeps up with the local art world as part of her job. She told the investigators that before the theft, Brewer left her a message at the front desk.

“I called him and he said, ‘Well, I have someone interested in buying Warhol,’ and I said, ‘Well, we’re not selling Warhol,’ and it was a very confusing conversation, but he said, ‘Well, I’ll just get him, I called him and I thought he wanted to sell, but he said he‘s going to buy, and I’ll just have him get in touch with you.’ I said, ‘Well, we don’t sell art from the museum,’ and that was the end of the call.”

The lawyer agreed that it was a “rather strange telephone call.” Museums usually don’t engage in day-to-day art sales like a commercial gallery or a dealer, and typically only sell collection items in times of great financial stress. The lawyer asked Buhr if she’d mentioned the call to law enforcement. Buhr said she told the FBI. Nelson also said he mentioned it to police.

Brewer’s version of the conversation differs from Buhr’s.

Brewer told the News-Leader that he contacted the museum after the theft, thinking it might want to replace its Warhols. He said he’d been in touch with a representative of a prominent gallery in the Southeast who also worked as a writer.

The writer had ties to Jose Mugrabi, a prominent art collector in New York said by the Wall Street Journal to own at least 800 Warhol pieces.

Mugrabi, Brewer had heard, was looking to sell.

“I called Sarah Buhr and said if you want to replace those with original art, this is the guy who owns most of the Warhols,” he told the News-Leader.

He insisted that the conversation took place after the Warhol theft, not before, as the museum had told the insurance company.

The insurance company asked about another incident. A week before the theft, the museum announced upgrades to the lighting in some of the galleries that would better protect the art on display.

The contractor on the project was working at the museum for several weeks, and to access the job site, they had checked out a key to an exterior alarmed door from the security guards.

The key went missing. Museum staff checked the sign-in sheet and confronted the person who had checked it out.

“They found it on the ground outside the door and that was suspicious,” Nelson told investigators. “It wasn’t so much that they had the key as that they found it immediately when we confronted them. It would be one thing if it was like, oh I forgot it and left it in my pants at home and I’m going to go home and get it and bring it back to you.”

Instead, the contractor said, “Oh, there it is,” and looked down and found the key on the ground under a dumpster.

“It was just very odd,” Nelson said.

Bridget Patton, an FBI public information officer stationed in Kansas City, declined to comment on whether the FBI interviewed any of the individuals mentioned in the sworn statements, citing the ongoing nature of the investigation.

She declined to provide any general update on the FBI investigation. No arrests or charges have been filed.

The seven prints remain listed on the FBI’s National Stolen Art File, along with about 90 other Warhols. There’s a $25,000 reward for information leading to their safe return.

At the museum, life continued following the theft.

Buhr told investigators that many of her art lenders called her up in the days after the theft, “freaking out” about museum security.

But since the Warhols were taken, the museum has hosted many shows with art from lenders, including a group of American Impressionist paintings on loan from Pennsylvania and a private collection of prints from Cuba currently on display.

The insurance company decided to pay the museum’s claim, at the upper end of the price range for a set of “Campbell’s Soup 1” prints.

In early 2017, the city received checks totaling $750,000. It turned over the remaining three Warhols to the insurance company as part of the settlement.

The museum finished the new emergency preparedness plan it had been working on before the Warhols were taken.

Nelson told the News-Leader that it’s easy to look back and speculate about the crime, but the museum is looking toward the future.

“There are a lot of unknowns out there, how could this happen, who could have done this,” he said. “And I think in a lot of ways those are distractions, and the real question is how do we prevent something like this from happening again, and that’s what we need to focus on.”

After the Springfield Art Museum got its national accreditation last year, it announced a $20 million renovation plan.

Over 30 years and three phases, the proposal would transform the museum.

The plan calls for sweeping glass walls and a roof simultaneously inspired by the flow of Fassnight Creek and the paper folds of Japanese origami.

In its first phase, the planned construction would completely replace the museum's Original Wing.

The current courtyard, where the Warhols went out in the middle of the night three years ago, disappears from the design.

The replacement courtyard would be bigger, open to the sky — but wrapped by walls on all four sides.

See Original Post

Reposted from Security Management

​Cybersecurity threats continue to grow and evolve. Trusted identities combat these threats as part of holistic, end-to-end solutions that combine multifactor authentication, credential management, and physical identity and access management (PIAM) and are supported by real-time risk profiling technology plus digital certificates, all bringing trust to the Internet of Things (IoT). Following are five of the top cybersecurity risks where trusted identities provide critical protection:  

1. Fighting fraud. Today’s risk management solutions use trusted identities and analytics to protect transaction systems and sensitive applications. Employing a combination of evidence-based capabilities, behavioral biometrics, and machine learning, these solutions help organizations detect phishing, malware, and fraudulent transactions. They can also prevent account takeovers and session stealing. 

2. User experience and business decisions. Besides detecting threats, adding an analytics engine behind an organization’s archiving solutions, digital certificates, and user location information enables organizations to realize other valuable benefits. Predictive analytics help pinpoint threats and facilitate countermeasures by defining a user’s attributes and behavior so that risk can be assigned to people and areas. It also provides insights around personnel movement in a building so organizations can optimize workflows and the usage of facilities, common areas, and individual rooms.

3. Securing the IoT. Digital certificates add trust in the IoT and are becoming a core component for combating cybersecurity risks. Trusted cloud services are used to issue unique digital IDs to devices ranging from mobile phones, tablets, video cameras, and building automation systems to connected cars and medical equipment. One example is cloud-based secure issuance, in which the use of digital certificates creates a trusted relationship between the cloud and all issuance consoles, printers, and encoders. Industrial IoT is another area that is seeing huge adoption in critical industries like utilities, oil and gas, chemicals, pharmaceuticals, transportation, and more, being able to collect and correlate physical, IT, and operational events from IoT devices. This multidimensional information can provide indicators of compromise that are otherwise hard to detect with traditional means.

4. Plugging gaps in security defenses. The move to unified identity management reduces risk by extending multifactor authentication across an entire identity and access management lifecycle. A cloud-based model is used to provision IDs and perform authentication for physical and logical access control. The next step is to migrate to convergence solutions that pull everything related to identity management into a unified system capable of granting and managing access rights. PIAM software is a key element, unifying identity lifecycle management by connecting the enterprise’s multiple and disparate physical and IT security systems to other parts of the IT ecosystem, such as user directories and HR systems, as well as cloud-based card issuance systems, wireless locks, and location-based services.  

5. Minimizing risks associated with GDPR compliance. PIAM software also simplifies General Data Protection Regulation (GDPR) compliance for physical security departments, automating previously manual processes of ensuring and documenting that all requirements are being met and data breach notification guidelines are being correctly implemented. It centralizes and applies policy- and rules-based automation for all compliance processes, from identity enrollment through auditing. It also ensures no individual names or other details are transmitted to access control systems, simplifies user consent procedures related to personal information, applies deep system integration to identify threat patterns, and provides robust compliance reporting.  

See Original Post

Reposted from StaySafeOnline

It may not be pleasant to think about, but even nonprofits fall victim to cybercrime.

According to numbers published in 2017, we know that in just two years, cybercrime incidents rose by 270 percent and cybercriminals seem to be targeting smaller organizations and businesses. Why? Because they’re less likely than big companies to have taken extensive security precautions.

That means even nonprofits are at risk online. If you’re the owner or manager of such an organization, you can’t rely on goodwill or flying under the radar — here are five suggestions for making your organization, and the people who represent it, more secure against cybercrime.

1. Take Stock with an Honest Risk Assessment

You can’t begin to make your nonprofit organization secure until you’ve fully audited what you need to protect. It’s possible you’ve only just begun the process of inventorying all the applications, data systems and devices your nonprofit uses to carry out its operations.

There are some very thorough digital inventory walkthroughs available online — and if this is your first time carrying out an online risk assessment, it’s probably a smart strategy to use one. Here’s a partial idea of the questions you’ll need to answer:

• What types of data does your organization collect and need to function?
• Where do you store this data?
• Who has access to this data and when was the last time their credentials were reviewed?
• What kinds of software applications do you use to interact with this data?
• Is the data you store and transmit subject to any regulations?

The answers to each of these questions will help identify weak spots in your data management policies and help you communicate more effectively about your needs with any third party cybersecurity professionals you may end up doing business with.

2. Split Your Local Networks

Your nonprofit almost certainly uses a local area network for all kinds of administrative, data handling and outreach purposes. Perhaps you rely on social accounts or network-connected storage devices to perform basic functions. You’re probably regularly emailing prospects and engaging in online networking.

Employees, volunteers and guests are likely generating lots of internet traffic on their devices — and that makes it a good idea to separate your network traffic by type, priority and sensitivity. Your approach could vary, but here’s the general idea:

• One network for guests
• One network for in-house personnel using web applications and internet telephony
• One network for “sensitive” information, including HR functions and accounting

By restricting access to each tier of your local network, you ensure your most sensitive information isn’t passing through the most well-trafficked part of your network.

3. Insist on Unique, Strong Passwords for Every Online Account

One reason cybercrime has become so pervasive is that many of us continue to choose convenience over adequate security. When it comes to creating passwords and logging into online accounts, two best practices should be at the focus of security training in your nonprofit:

1. Unique passwords are essential, so data thieves can’t commandeer multiple web properties using the same set of stolen credentials
2. Implement strong password policies: A strong password is a sentence that is at least 12 characters long. Focus on positive sentences or phrases that you like to think about and are easy to remember (for example, “I love country music.”). On many sites, you can even use spaces!

Now you know more about what to do, and what not to do, make sure each of your additional nonprofit volunteers know too.

4. Don’t Take Email Security for Granted

None of us can take email security for granted any longer. The foundational design of email, as a technology, didn’t take modern privacy and security safeguards into account. We should probably get used to the idea that even encrypting our emails will never be enough to protect our correspondence from potential eavesdroppers.

That’s not to say your organization should stop using email. But let this serve as a wake-up call to exercise judgment when it comes to exchanging information and documents over email.

If your nonprofit uses email regularly — for donor outreach, perhaps — you need to ensure good email security practices are part of your training. No matter how many inbox filtering rules we write, we all get suspicious-looking emails from time to time.

And if it looks suspicious, it probably is. Look out for conspicuous misspellings in any emails you receive — especially if the sender is making claims about your online accounts being “locked” or inviting you to participate in a survey for a reward. The point of these emails is to encourage the target to click a link, which might install malware or provide another way in for cybercriminals.

Make your employees and volunteers aware of phishing techniques like these so they don’t get blindsided and end up putting your whole organization at risk.

5. Consider Cybersecurity Liability

Cybersecurity liability is a relatively new area of expertise for insurance companies but given how many types of threats exist across the digital landscape, it’s probably here to stay.

To be clear, the “security” delivered from cybersecurity liability isn’t about preventing the loss of data — it’s about insulating yourself against the financial fallout of a cyber incident. A cybersecurity liability policy will cover monetary damages from lost data, as well as costs incurred as a result of ransom and extortion.

The price of having your data held for ransom can be high enough to ruin smaller businesses and nonprofits. Cybercriminals who lifted data from the Indiana-based nonprofit Little Red Door ordered the organization to pay $43,000 to ensure its safe return.

Cyber liability insurance is probably not your priority as a nonprofit manager. Instead, start with the basics listed in this article, then work on making cybersecurity an integral part of your organization’s culture. With the fundamentals covered, you can turn your attention to more advanced tools.

See Original Post

Reposted from Security Magazine

During the past decade, many corporate security divisions have made tremendous strides to evolve as a key component of their company's organizational strategy and growth.

Whether a company's security program is in-house, outsourced or a hybrid of both, the leading global security executives and decision-makers are acutely aware of how to effectively leverage the resource capabilities of intelligence professionals within their organization.

Security leaders should consider these five top reasons why intelligence professionals should be embedded into their security program:

1. Optimization

Aristotle once said: "The Whole is Greater than the Sum of its Parts." Intelligence professionals possess valuable tacit knowledge and abilities that can assist security divisions with building synergies across the different business lines and functions within an organization.

For example, the head of operations and other business heads at Company X are considering expanding manufacturing operations into Latin America.

A feasibility study quickly ensues and Company X ultimately decides to expand into the new market because of its cost savings, profit margin potential, above average labor standards and excellent track record with other U.S. firms that previously expanded operations there.

A risk intelligence analyst gets wind of Company X's expansion plans and spends a few days deciphering and analyzing data from a wide array of sources regarding Company X's target market. The analyst produces a concise risk intelligence report and submits it to their boss. The report concludes that entry into the new market is too risky due to burgeoning political instability which would inevitably lead to escalating violence.

The analyst also provides strong supporting evidence that the country has a history of seizing foreign businesses when their governments become unstable and offers alternative markets that would still be financially beneficial for Company X in the long-term.

The intelligence report is well received, but it also proves to be a learning moment for the Head of Operations and other business heads while showing the capabilities of the security division. This strategically places them in a more proactive posture as they are invited to have more input in helping to design organizational strategy going forward.

2. Agility

The success of a company's Corporate Security Division is dependent upon its ability to respond swiftly to impending threats. Failure to do so could result in catastrophic losses in the millions.

As key drivers of the security function, embedded analysts play a key role in developing actionable intelligence for the security team. The security team typically doesn't have the luxury of time or the unique competencies to collect, analyze and synthesize vast amounts of information and distribute it in a meaningful way to help leaders make sound decisions.

Take, for example, a corporate executive who needs to fly out on a moment's notice on an emergency business trip to one of the company’s major global supply chain operations in Kazakhstan. They will require more than just the standard off-the-shelf situational report from his security team.

Rather, an intelligence analyst would need to provide the executive with a comprehensive situational awareness and travel risk assessment report tailored to their travel. The report would highlight key areas such as the current overall threat environment and whether there are any geopolitical or business risks and how that could impact their core business.

Talented intelligence analysts can respond quickly to these unexpected events and produce timely and accurate intelligence reporting that entails a 360-degree analytical review of the country's risk profile and any potential operational impact to the business.

3. Identify Gaps

Effective security leaders must demonstrate a fair amount of finesse in their approach to managing risks. They must make accurate and timely decisions and advise senior leaders on potential business risks of critical importance. They must do so while ensuring that their security policies and recommendations are crafted and implemented in a manner that does not disrupt business operations. Unfortunately, security teams don't always get it right, and sometimes mistakes occur.

Experienced intelligence professionals can help security divisions with developing accurate forecasting models by identifying intelligence gaps that are critical to the various business lines of a company. In other words, if you have sufficient data on a particular area or subject, then where are you deficient?

Let’s say your security team completed an updated risk assessment of a relatively stable country, home to one of its Southeast Asia operations. The assessment suggested that all indicators were in the low- to medium-risk range to operations.

However, while reviewing the risk assessment an analyst discovered that the country's geopolitical risk profile was lacking vital information regarding a pending election that was rumored to cause heavy political instability. The newly discovered gap helped the organization to revamp its security strategy and implement the requisite safeguards to prevent disruption of business operations.

4. Diverse Skill Sets

Adept Intelligence professionals have fundamental analytical skills that can make an immediate impact to an organization's security division. However, the best security divisions employ embedded analysts that can draw upon their expertise to improve the team’s intelligence capabilities.

For example, an analyst that is an expert on a particular region of the world will produce superior intelligence reporting than a generalist practitioner.

Perhaps the analyst had the opportunity to live abroad and became fluent in the language. These are invaluable skill sets that cannot be ignored. Some analysts may have superior computer programming skills and have the capability to write programs that could streamline efficiencies for a security division thus saving them money. 

Security executives must set their priorities on attaining the highest return on their investment when building a global intelligence team.

Intelligence professionals with dual specialties in software programming, data analytics, cybersecurity, foreign languages and business are just a few of the highly desirable skills that security executives should be keenly reviewing when considering which prospective candidates would be the right fit for their program.

5. Forecasting

Distributing intelligence on a threat that has already occurred or that is untimely holds no benefit to key stakeholders and decision makers. Every day, many companies are vulnerable to billions of dollars in losses due to unforeseen threats. The need for developing and disseminating predictive intelligence are primary factors in a company’s ability to stay ahead of emerging threats that may hamper their bottom line.

Risk intelligence platforms which incorporate robust machine learning and data analytic tools coupled with the keen eye of an intelligence analyst will help to enhance situational awareness for your security division and equip them with the capability to respond rapidly to emerging threats.

This is an area that cannot be overstated enough. The strongest security teams of the future will implement augmented intelligence programs (the combination of human and artificial intelligence) into their platforms.

This is an added dimension for intelligence analysts as it will improve their ability to supply decision makers with faster and more accurate real-time and predictive intelligence. Security executives that embrace these emerging platforms, coupled with experienced intelligence analysts in their security architecture, will make the security program extremely valuable to their companies.

Leveraging Intelligence Effectively is an Art

There is no one-size fits all approach to leveraging talented intelligence professionals into your security program.

Security leaders must give careful considerations to budgets. Should the intelligence function be designated as a full-time position, outsourced, or a combination of both? The intelligence function will also be shaped by the level of involvement security leader’s play in helping to formulate organizational strategic objectives.

Building a high-performing security team will require an in-depth resource and capability analysis of your security architecture in helping to guide your selection of the best intelligence professionals with the right blend of complementary skills for your program.

See Original Post

Reposted from Security Magazine

Top password manager products have fundamental flaws that expose the data they are designed to protect, rendering them no more secure than saving passwords in a text file, according to a new study by researchers at Independent Security Evaluators (ISE).

"100 percent of the products that ISE analyzed failed to provide the security to safeguard a user’s passwords as advertised,” says ISE CEO Stephen Bono. “Although password managers provide some utility for storing login/passwords and limit password reuse, these applications are a vulnerable target for the mass collection of this data through malicious hacking campaigns.”

In the new report titled “Under the Hood of Secrets Management,” ISE researchers revealed serious weaknesses with top password managers: 1Password, Dashlane, KeePass and LastPass.  ISE examined the underlying functionality of these products on Windows 10 to understand how users’ secrets are stored even when the password manager is locked. More than 60 million individuals 93,000 businesses worldwide rely on password managers. 

Password managers are marketed as a solution to eliminate the security risks of storing passwords or secrets for applications and browsers in plain text documents. Having previously examined these and other password managers, ISE researchers expected an improved level of security standards preventing malicious credential extraction. Instead ISE found just the opposite. 

Data Stored in Plaintext When Locked

One major finding was that, in certain instances, the master password was residing in the computer’s memory in a plaintext readable format -- no safer than storing it in a document or on the desktop as far as an adversary is concerned. Users are led to believe the information is secure when the password manager is locked. Though, once the master password is available to the attacker, they can decrypt the password manager database -- the stored secrets, usernames and passwords. ISE demonstrated it is possible to extract master passwords and other login credentials from memory while the password manager was locked.

Simple Forensics Can Extract Master Passwords

Using a proprietary, reverse engineering, tool, ISE analysts were able to quickly evaluate the password managers’ handling of secrets in its locked state. ISE found that standard memory forensics can be used to extract the master password and the secrets it’s supposed to guard.

“Given the huge user base of people already using password managers, these vulnerabilities will entice hackers to target and steal data from these computers via malware attacks,” says lead researcher, Adrian Bednarek. “Once they have your master password, it’s game over.”  

 “People believe using password managers makes their data safer and more secure on their computer,” says ISE Executive Partner Ted Harrington. “Our research provides a public service to vendors of these widely-adopted products who must now mitigate against attacks based the discovered security issues, as well as alert consumers who have a false sense of security about their effectiveness.”

ISE recommends that to keep secrets more secure until vendors fix the issues, password manager users should not leave a password manager running in the background, even in a locked state, and terminate the process completely if they are using one of the affected password managers. 

Click here for a copy of the report.

See Original Post

Reposted from TribLive

February 26 marked 26 years since six people were killed and more than 1,000 were injured in the Feb. 26, 1993 attack on New York’s World Trade Center.

At 12:18 p.m., a small group of terrorists detonated about 1,200 pounds of explosives in the underground parking garage below the World Trade Center complex in lower Manhattan by driving a rental van into the space, according to an overview of the attack provided by the 9/11 Memorial and Museum in New York City.

Among those injured were 88 firefighters, 35 police officers and an emergency medical services worker, according to the 9/11 Memorial and Museum website.

It took more than four hours to evacuate about 50,000 people from the complex.

The North Tower lobby filled with smoke, and several areas within the North and South towers lost power. Hundreds of people were trapped in elevators as the emergency power generators, which were damaged in the explosion, failed.

Speaking with radio station WCBS, former New York City Police Department Commissioner Raymond Kelly recalled evaluating the damage with a Port Authority engineer.

“We were looking at the, sort of the base of the building, and he made a statement: ‘These buildings could never come down,’” Kelly said.

A five-story crater below the complex was created by the explosion.

Though several security measures were put in place following the attack, Kelly said more should have been learned.

“Vehicle checks were installed in so many places, the World Trade Center itself received security upgrades, probably over $1 million, but it was all pretty much on the ground,” Kelly told WCBS. “We simply didn’t anticipate attacks by aircrafts.”

Of the six men convicted for the bombing, five are serving their sentences at a maximum-security prison in Colorado, according to the 9/11 Memorial and Museum website. A sixth is serving his sentence at a facility in Indiana. The case remains open because a seventh alleged conspirator was never caught.

See Original Post