Security Update – 11 August 2009

Incidents of data theft and corporate espionage are now occurring more regularly due to a combination of inadequate corporate security measures, increased competition between companies due to pressures associated with the financial crisis, and enhanced internal security risks resulting from mass employee layoffs.

Corporate espionage is a major security risk as organisations frequently store sensitive data in vulnerable locations which allows a large number of employees access using a range of devices. The anonymous storing and transferral of large quantities of data has become all too easy due to web-based emails and social networks, and the vast amount of memory available on mobile phones, digital cameras, and portable USB devices. Mobile phone spy software and listening devices have also become widely available.

The majority of data security breaches tend to occur via internal sources. A recent survey by the information security company, Cyber-Ark Software, found that 35 percent of Information Technology (IT) workers admitted to accessing corporate information without authorisation, while 74 percent claimed to be able to circumvent security controls in place to prevent access to internal information. The survey interviewed 400 IT professionals from major companies in the United States and United Kingdom and found that the most commonly targeted sensitive data included customer databases, human resources records, marketing information, merger and acquisition plans, layoff lists, email controls and CEO passwords.

The security risks associated with laid-off employees are increasingly problematic in the current economic climate as widespread redundancies occur. Many laid-off employees are tempted to leverage off confidential information for sale or use in subsequent jobs. Cyber-Ark’s survey found that there had been a drastic increase since last year in the number of respondents stating that they would take proprietary data and information with them, should they be fired. The survey found that there had been a six-fold increase since 2008 in the number of respondents stating that, if laid off, they would take financial reports or merger and acquisition plans with them. Meanwhile, there was a four-fold increase since 2008 in the number stating that they would take CEO passwords and research and development plans in such an event.

International Operations Group - Analysis

Unauthorised access to information exposes confidential customer financial and personal information to criminal acts and can cause significant damage to a company, both financially and in terms of reputation . A large number of organisations do not dispose of confidential information securely and, as such, risk losing highly valuable data or being victims of fraud, blackmail and identity theft. Confidential data should be kept in a safe location and disposed of in a proper manner, as a failure to do so contravenes strict data protection laws.

Appropriate measures should be taken by all types of organisations to reduce the likelihood of data theft and corporate espionage occurring. The number of individuals with access to funds and critical information must be strictly regulated to those for whom access is essential and the movement and downloading of data should be closely monitored, particularly during times of mass layoffs. Information theft mitigation processes need to be in place well before rumours of layoffs start to circulate.

Other effective measures may include the enhancement of physical security policies and procedures, an increase in security camera coverage, stricter controls on the classification and management of critical information and various other measures, tailored to specific business environments. Organisations must ensure that these security enhancements are publicised internally, via security awareness programs. Regular counter-surveillance inspections should also be conducted, as a part of an enterprise-wide security program.

International Operations Group - Services

International Operations Group can assist in the detection and deterrence of acts of espionage. We offer an enhanced range of surveillance detection and technical surveillance countermeasure (TSCM) capabilities and use up-to-date technology equipment and processes to ascertain whether an organisation or individual is the target of surveillance or internal espionage. Our security consultants are experienced at operating in corporate, executive management and government environments across the globe.

Please email us at 2009@interopsgroup.com or telephone us on +61 2 8003 3933 for additional information or confidential counter-espionage support.

For more information on our fee-based intelligence updates or bespoke reporting, please email Rob Stevenson - rob@interopsgroup.com. Rob can also be telephoned on +61 [0] 420 244 909.