How to secure IP against threat or compromise

Digital Guardian’s Tim Bandos breaks down the best practices for protecting intellectual property against unauthorised access

Hackers are becoming more sophisticated and determined than ever. According to a Clark School study, there is a cyberattack every 39 seconds – a stat reflected in estimates that put the global cost of cybercrime at $6 trillion annually,

Among the many areas of concern are the risks of Intellectual Property (IP) theft, defined by the FBI as “. . . robbing people or companies of their ideas, inventions, and creative expressions . . . which can include everything from trade secrets and proprietary products and parts to movies, music, and software.”

The economic scale of the problem is alarming. A 2019 CNBC survey, for example, revealed that 30% of US corporations claimed their IP had been stolen by organisations based in China during the previous ten years.

And a regularly cited report, published in 2017 by the National Bureau of Asian Research, suggests “the annual cost to the U.S. economy continues to exceed $225 billion in counterfeit goods, pirated software, and theft of trade secrets and could be as high as $600 billion.”

So, how should businesses respond?

Protecting IP against unauthorised access

According to the non-profit Alliance for Gray Market and Counterfeit Abatement (AGMA), securing IP through methods such as encrypting sensitive data, user training and awareness, event logging and visibility, is key to keeping ahead of emerging threats.

In fact, tight security protocols that protect against both external and insider threats are now ‘must-haves’ when formulating an IP protection strategy.

A key component of protecting IP is access control policies and procedures. The AGMA advises that, “ensuring a comprehensive access review of all applicable systems is imperative to identifying access risks. This should include appropriately restricting access and ongoing reviews of access levels. A robust access control policy should outline the controls placed on both direct and remote access to computer systems to protect networks and data.”

Following AGMA’s guidelines isn’t mandatory, but its advice and experience could certainly contribute to the prevention of IP theft in many countries. They also urge companies to ensure they comply with standards like HIPAA, NIST, GDPR, and any other relevant international codes.

But that’s just the start. Best practice also requires event logging and visibility are important tools in building an understanding of what’s happening across a company’s IT environment.

The AGMA encourages organisations to log and retain comprehensive records of events, when they’ve occurred, where, the source of the event, the outcome, and the identity of any individuals or subjects associated with the event, for example.

Data analytics should be employed to monitor and identify trends or transactions outside of norms or expectations. “Any unauthorized use should be reported to the appropriate parties, and enforcement actions should start immediately,” the AGMA suggests.

Awareness training in the fight against IP theft

Information security awareness training is a blind spot for many organisations, but it’s essential in tackling IP threats.

The risks of unintentionally exposing IP to thieves can be mitigated by investing in comprehensive training for anyone who has access to IP assets. This is part of a strategy of continuous improvement, because “securing digital IP is not a ‘one and done’ activity.”

The AGMA advice is that “monitoring information security best practices, performing risk reviews, and scaling security policies and controls continuously is needed to keep ahead of emerging threats,” adding that companies should build a culture that prioritises regular security improvements.

The AGMA also advocates security by design. “Planning and policies for building security upfront (vs. after the fact) should be implemented and adhered to, as it is much more expensive to add security later than it is to design it in right from the start. Security capabilities should be proactively included within applications, programs and infrastructures.”

Combined, this represents sensible advice and will also remind many organisations how their current security protocols – or lack of them – may be increasing their vulnerability to IP theft. It also underlines the wider importance of data loss prevention and the severe financial risk that builds when security strategies are sidelined in either the short or long term.