Corporate Espionage is undoubtedly an evil that thousands of competitive companies have to live with, asking senior executives how these spies did to steal confidential information from the company in a secure environment.
In today's global and highly competitive market, those who must face decision-making in the business environment require a solid information base in everything related to the strengths, vulnerability, strategies, plans and interests of competitors or of possible partners.
The businessman, the politician, the industrialist, etc., is currently exposed to a series of risks of different kinds (financial, patrimonial, image, personal, etc.), some of them do not understand that the risk of commercial, industrial and political espionage exists, and its consequences can be serious. Corporate espionage is by no means a recent danger. Currently it is estimated that 70 percent of a corporation's median value resides in the information it owns (Source: Trends in Proprietary Information Loss - Trends in Loss of Confidential Information, American Society for Industrial Security and PricewaterhouseCoopers, 1999).
Many of the most successful corporations today have suffered incidents of corporate espionage, and the number of these cases is constantly increasing. In 1999, Fortune 1000 companies reported a total of $ 45 trillion in losses due to corporate espionage (source: Trends in Proprietary Information Loss - Trends in loss of confidential information, American Society for Industrial Security and PricewaterhouseCoopers, 1999). Computer technologies are clearly a breeding ground for the theft of confidential or protected information used by these corporate spies. CIOs must spend time protecting the company, applying appropriate security measures for their network and setting effective standards.
The most valuable information currently is stored electronically and, since computers are networked and online, or accessible by other physical means, the chief systems officer plays a critical role in defending the corporation against the activities of espionage (and in stopping those activities when they are discovered). Although corporate espionage incidents most likely cannot be completely eradicated, corporations can modify their security strategies to minimize incidents and the losses they cause.
Among the direct risks related to people who have access to confidential information and special access, there are three main types of dangers that can facilitate corporate espionage:
- Bribery: Employees may receive direct offers from intelligence officers of other corporations, who offer cash in exchange for confidential or protected information. Social Engineering: The manipulation of a network administrator or other people in the systems department (either by people from the corporation itself or by third parties) to disclose information, such as login data or other data from authentication, which can then be used to gain access to sensitive information. Collusion in Groups: When several employees join forces to use their collective knowledge and privileges to gain access to information.
Corporate espionage by outsiders receives more media attention than illegal staff activities, especially since the network protections applied against external spies are similar to those used as protection against hackers. Vulnerabilities in a network that allow outsiders to access your network will eventually allow them access to the protected information they seek.
In the case of external spies, the common methods of gaining access to protected data are as follows: DECRYPTED PASSWORDS, REAR DOORS AND HORSES OF TROYA, PACKAGE "SMELLING", SOCIAL ENGINEERING, others.
Vulnerabilities in a network that could lead to information leaks include web presence, email, and user activities on the Internet, your intranet, and access privileges.
Although they do not directly affect the systems department, physical methods can also be used, such as the subtraction of laptop computers and the intervention of data lines. In order to protect itself from the misuse or accidental leakage of internal information to external spies through the network, the corporation must evaluate and classify information assets and design implementation standards and solutions that will reduce unauthorized access to These data.
The solutions to be applied are the following:
- It is necessary to monitor email and Internet traffic to prevent the transaction of confidential data over the network. Filtering Internet content helps limit access to Web sites, which can compromise the confidentiality of the corporation. Email filtering can prevent the transmission of confidential information via email, including authentication information or protected data. Using comprehensive antivirus solutions, including Trojan horse search, will help you eliminate espionage corporate (and the resulting data thefts) through backdoor methods. Intrusion detection software products will allow exclusive access by authorized persons to restricted areas of the network.The systems department can receive alerts about intrusion attempts and can act accordingly. Vulnerability assessment solutions will help the systems department understand the security architecture and vulnerabilities of each component within the structure. They will help CIOs obtain network audits as well as develop and improve protections.
Implementing standards will help the systems department develop a robust set of network configuration standards. These rules can also help you establish access rules, so that you can better monitor activity and detect possible intrusions. As for users, the rules will ensure that they understand what is the proper use of the resources of the corporate network. These standards help establish incident management procedures. As another possible solution to eradicate corporate espionage is cooperation between corporations and the competent justice authorities during espionage investigations to help the Administration to better understand the future dangers to the security of public infrastructure..Previously, many corporations were reluctant to report security breaches. Since espionage is a very expensive intrusion, corporations are much more willing to blame spies.
Contrary to hackers or viruses, the losses caused by espionage can be recovered, since the intrusions are facilitated by competitors or even official organizations, which can pay for the repair of the losses after the appropriate legal actions..
In conclusion, a competitive market in which information is a precious asset, espionage is not likely to disappear. Many experts predict that espionage will grow in the future, especially as the general public has access to the Internet and other electronic technologies worthy of James Bond himself.
Despite the fact that espionage cannot be eliminated, the implementation of protections in the network at least minimizes the loss of confidential information by electronic means.
