Tuesday, June 28, 2016

Best Practices for Discouraging Internal Key Theft

Handing keys to employee.
A few years ago, a 38 year-old California man strolled into a San Bernardino-area dealership, pocketed a pair of keys and drove off in another person’s vehicle — all during business hours. It turned out the man had previously been employed at the dealership, so he knew exactly where keys were kept. 

This incident is one of many that happen across the nation every year. In fact, research indicates that the number one source of shrinkage for retailers in 2015 was employee theft. 

Although not every theft is preventable, you can follow a few best practices to reduce the likelihood of internal key theft. 

Promote Accountability

It's unclear how the San Bernardino man gained access to customer keys without turning heads. However, if you’re concerned about a similar security breach, updating manual key control processes to electronic key control could help deter theft. 

By requiring users to log in via password, key fob and/or fingerprint scan, the system creates an audit trail so you can review exactly who’s accessing which keys and when. Additionally, with an electronic key control system in place, dishonest associates won’t be able to argue against the validity of key control logs. This reality will resonate with your employees, discouraging potential theft. 

Separate Employee Responsibilities

In some businesses, it’s not uncommon for the employee handling alarm codes to also be the keeper of the keys. In the event an alarm goes off, however, this arrangement can easily become a conflict of interest. If you designate a single employee to handle both responsibilities, that employee could 1) commit theft nearly unnoticed, or 2) leave keys unmanned long enough for another employee to commit theft.

To limit this liability, consider designating multiple system administrators, so that no employee has unchecked access to security measures. Designating several system administrators distributes accountability, which is beneficial for several reasons: 
  1. If one administrator isn’t present you’ll still have access to the system.
  2. You eliminate the risk of a conflict of interest.
  3. Each administrator can still complete daily tasks without compromising key security.

Disable User Accounts After Employees Leave

When an employee leaves, it's important to ensure they don't still have access to company systems and assets. The same electronic key control system that allows you to set up multiple users also allows you to remove terminated employees from the system. In doing so, you can protect your company against potential credential abuse. Whether it’s an employee trying to clock in for a coworker, or an ex-employee looking to steal from their former boss, password security is not to be taken lightly. 

For more information on how to maintain key security, read our post “Do You Know Where Your Keys Are?” 

Monday, June 20, 2016

Brazen Car Thief Takes Ohio Dealership by Surprise

Car thief at nightIt took only nine minutes for a car thief in Columbus, OH, to walk into a dealership, take a set keys that was left unattended and drive off the lot in one of the dealership's cars — all while employees and buyers were still on the showroom floor.

The Toyota West dealership was just closing when the thief came to perform his quick heist. Despite security cameras recording his every move and the activity of employees on the sales floor, the perpetrator was able to steal keys to a $12,000 SUV, which he drove off in. The security cameras showed a distraught salesman looking for the keys seconds before the thief drove the vehicle off the lot. The keys had been left unattended, possibly after a test drive.

Employee accountability is vital at dealerships, where keys need to be easily accessible for test drives or maintenance work. When keys are misplaced or stolen, dealerships face liability risks as well as the extra expense of replacing keys. To limit liability and avoid these potential expenses, some dealerships use an electronic key control system

By requiring employees to check out keys from the key control system, dealership managers can know who has accessed a specific key and when, while ensuring keys are returned on time.

If you’ve implemented an electronic key control system, take advantage of its ability to create an audit trail in real time when enforcing policies like requiring all keys to be kept in the system and setting up user profiles to allow only authorized employees to gain key access. To prevent theft, keep employees accountable for returning keys to the system right after test drives, minimizing the possibility of a quick heist like the one mentioned above.

To learn more about the importance of employee accountability, check out this post.

Thursday, June 9, 2016

$16,000 Thefts From Toronto Police Stations Show No Signs of Forced Entry

In the last five years, Toronto Police stations have seen more than $16,000 worth of items go missing and have received 46 reported thefts.
Key in Lock

The biggest loss the stations faced was the theft of a manila envelope with more than $2,500 in cash for police gym memberships. The envelope was taken from a shared locker.

The stolen items also included equipment used for station operations and community events. Thieves swiped a bulletproof vest, a gas mask, building materials for a new police station and $1,500 in camera equipment the Toronto Police Intelligence Services had purchased.

With the stations’ history of thefts, one station locked up two Xbox game consoles, which the station had purchased for a local event where neighborhood youth could play video games with officers. Somehow, however, a thief allegedly got hold of a key to the basement where the equipment was kept and stole a console and video game worth nearly $260.

Thieves have also targeted miscellaneous personal items left on police properties.

There were no signs of forced entry in any of these thefts, but without an adequate audit trail, there is no way to know if the theft was an inside job.

Toronto Police stations would have benefited from having a process for securing keys and creating an audit trail of all employees who used those keys. For example, if the stations implemented a high-security electronic key control system, they could control access to keys by keeping them physically locked down in a secure panel or electronic drawer.

The system would require authorized users to log in via biometric fingerprint authentication or password, and a report of all system activity would be automatically recorded. In addition, some electronic key control systems include a built-in, motion-activated security camera, which would provide an additional level of insight into system activity.

To ensure managers were always informed of who was accessing the organization’s valuable keys and assets, system reports and alerts could be sent directly to the system administrator(s) via text or email.

For more information on how electronic key control helps with asset management, check out this post.

Friday, June 3, 2016

Key Theft Puts Des Moines Properties at Risk

All it took was an unlocked truck parked in a fast-food lot for a thief to gain access to city properties across the entire city of Des Moines, IA.

Up-close photo of set of keys. Late last year, a city employee stopped at a fast-food restaurant for lunch, leaving a set of city keys in his unlocked truck. Someone then opened the vehicle doors and stole the employee’s lunchbox with the set of keys inside, giving the thief access to several locks around the city. Just a few days later, the city’s softball park was broken into, though it wasn’t confirmed if the two incidents were related.

With the loss of these keys, the city faced the large cost of re-keying locks and replacing keys. The city can help prevent future incidents and unwanted spending by using an electronic key management system.

In the system, keys are securely locked away in electronic steel drawers that can only be accessed using a fingerprint, password or key fob. The system provides a complete overview of key activity, which allows managers to determine which employee has been using a particular key. If an incident occurs in which a key is lost or stolen, management can immediately determine who the responsible employee was and take action.

In addition, the system activity can be viewed on the web in case managers are not on-site and are unable to physically log in to the system.

Click here for another example of how implementing access levels could have helped keep employees accountable and reduce theft.