Despite the almost daily headlines of one or other company being hacked, their non-public information exfiltrated and put up for sale on a hacker forum somewhere on the dark net, the fact remains that the vast majority of proprietary information stolen from companies leaves via the front door – not by remote hackers and their tool chests of malware, phishing schemes, and the like. In fact somewhere in excess of 70% of stolen corporate non-public information walks out with employees, contractors, partners and interns. This ranges from simple customer contact lists with those moving to their next job, to current new business opportunities, to full-blown intentional, corporate espionage and overt theft of intellectual property and trade secrets – formulations, inventions, research, etc.

The need to implement tools like Cisco ISE and TrustSec to isolate different users and groups, and to allow access only to those with a legitimate need to know is more important now than ever. As Target found out, granting remote network access to its refrigeration vendor, without the correct controls allowed those vendor credentials to be used to access its payment card systems, resulting in the theft of 40 million credit card numbers and 70 million customer personal records.

The on-site human component may be combined with malware and other tools of the trade to elevate privileges and access protected information then posted to cloud file-sharing services or copied down and physically removed on laptops or removable media. Most companies have security and other policies that are designed to prevent the exfiltration of company information by “friendlies” (insiders), but rarely are these policed in most organizations. Compounding this fact is that much more goes out the front door than is ever realized. A recent case I worked showed that US university interns under the pretense of gaining job experience as part of their degrees, were purposely looking for and taking well-honed operating and lab procedures, perhaps decades in development, back to their native countries to boost their domestic industries and to then compete head-on with the company they did their internship with.

It’s a fine line between security and productivity but you are absolutely correct in that espionage alive and thriving in the digital world. Its just in a different form than it was during the Cold War.