Introduction

In this previous post, I discussed what we mean by intellectual assets and confidential information, and who might want to compromise it. I again pick up the topic of confidential information which is the foundation of any trade secrets protection in Australia. This post provides an overview of what I consider the nine main attack vectors for confidential information, why it is important to understand the value of your critical information assets before spending money to protection them, and how managers can build a confidential information protection program for their business.

Confidential information can be compromised through 9 main ‘attack vectors’

Sensitive, non-public information can be compromised through a range of avenues (attack vectors) by external parties or trusted insiders. The following list, whilst not exhaustive, illustrates the sheer number of avenues by which sensitive business information can be compromised:

• Espionage techniques – whether perpetrated by competitors, ‘information brokers’ or nation states
• Cyber attacks – by far one of the easiest, lowest risk and most successful vectors if recent events are any indicator
• Insider threats – including theft, copying, unauthorised disclosure, ‘innocent disclosure’ (i.e. intentional disclosure made to look like an accident) and large scale data leaks
• Technology transfer – through acquisitions and licensing
• Research partnerships
• Staff exchanges, secondments and laboratory visits
• Direct investments – including venture capital and private equity
• Listings on foreign stock exchanges – where foreign governments may seek to forcibly access premises or IT systems and copy information
• Supply chain infiltration – including of Contract Research Organisations and Contract Manufacturing Organisations

Each of the above is an example of a vector used to obtain sensitive business information. Typically, threat actors start with the easiest and least expensive option. Professionals who engage in wholesale sensitive information theft, whether of PII or intellectual property, are typically very patient and may be willing to wait years for the right opportunity. Companies which create valuable information assets often have better security and greater staff security awareness (i.e. are a harder target), thus they are likely to be on the receiving end of more sophisticated methods by opponents. Fortunately, this does not mean protecting sensitive information is impossible. Rather, what it requires is a robust framework to mitigate the risk.

Before protecting information, we need to understand its value

It is not practical or cost-effective to protect every asset in an organisation to the same standard, and this goes double for information. A foundation principle of security is only apply controls to assets of value. This is relatively simple to determine for tangible, physical assets, but in practice is somewhat difficult for intangible assets. In my consulting practice, I have worked with a number of knowledge-intensive organisations to identify and assess their sensitive information. This exercise is really all about balance, compounded by the fact that information at the start of a process (e.g. commencement of R&D) may not be valuable, whilst at some point along the way the confluence of events means information becomes highly sensitive.

The challenge is to identify the point at which that happens, as too many controls will affect the productivity of knowledge-workers who instinctively want to share and learn. Locking information away in silos goes against the innate behaviour of knowledge workers and will also impact your organisations ability to innovate. In contrast, inadequate control coverage means valuable information is not adequately protected and could easily be lost. Coincidentally, I completed my Master’s level research project on this very topic as part of the Technology Management program at the University of Queensland Business School.

---

---

When working with clients I typically follow a five step process to complete this exercise:

1. Compile an inventory of all types of information within the organisation, the creator (originator) and recipients, and where it is stored
2. From this inventory, group the information into categories such as public, Personally Identifiable Information, non-sensitive business information and Sensitive Business Information. This activity can quickly become unwieldy, so you will probably need to sub-categorise information as you go
3. Rank or prioritise your information from most to least sensitive. This might be on the basis of value (i.e. potential future revenue generating capacity), regulatory compliance or reputation / commercial damage if disclosed (e.g. loss of market share)
4. Identify your internal control environment in relation to your most sensitive information. Is this information adequately protected?
5. Focus your information protection program on these areas and develop a plan to uplift internal controls were gaps exist, leaving information unprotected

How do you build a confidential information & trade secrets protection program?

In larger companies, sensitive information protection programs typically comprise a specialised element of the enterprises’ broader corporate security program, which provides the security foundation on which information protection builds. Smaller organisations, however, may not have a robust security program in place beyond a limited IT Security capability and a security manager responsible for security guard-force management. Corporate security programs today involve far more than security guards – they have evolved to a high level of sophistication to address the diverse range of complex threats faced by companies operating domestically and overseas. More on this in future posts.

There are seven key components of a confidential information protection program

The seven key elements of a confidential information protection program are as follows:

1. A framework which brings together all relevant program elements, identifiers risk owners and stakeholders, and sets the tone from a policy implementation and guideline perspective. This framework should be subordinate to other organisational frameworks, such as Risk and Compliance
2. An appropriate Information Registration, Classification, Marking, Tracking & Destruction scheme to ensure sensitive information is clearly identified and can be protected at each phase of the lifecycle
3. Security awareness training for all staff, but particularly those working with (or creating) the sensitive information
4. Tone from the top, with the importance of information protection being clearly recognised and with executives and the board following internal procedures
5. A threat and risk assessment, to clearly identify the threats and risks to the sensitive information and the associated controls
6. A risk-based protective security program comprising physical, cyber, information (non-cyber) and personnel security elements to address the risks, and
7. Appropriate detection, incident management and investigation capabilities to enable timely detection and response to any incident, minimising further damage

To ensure adequate stakeholder engagement and ownership, sensitive business information programs should be led by the business risk owner who has the most to lose if the information is compromised. A working group or steering committee should be formed involving representatives from legal, finance, human resources, IT, marketing, R&D, sales and distribution, and corporate security. These programs need to be owned by the business – information protection programs owned by ‘security’ are doomed to fail through inadequate stakeholder engagement and support.

Further reading

• ASIS International (2007). Information Asset Protection Guideline, ASIS Commission On Standards And Guidelines, Alexandria.
• Centre for the Protection of National Infrastructure (2015). CPNI Passport to Good Security for Senior Executives, UK Government.
• Curwell, P. (2021). In business, confidential information is a critical asset
• Gelles, M. G. (2016). Insider Threat: Prevention, Detection, Mitigation and Deterrence, Butterworth-Heinemann, Oxford.
• Moberly, M. D. (2014). Safeguarding Intangible Assets, Butterworth-Heinemann, Oxford.
• Post, R. S. and Post, P.N. (2008). Global Brand Integrity Management: How to protect your product in today’s competitive environment, McGraw-Hill, New York.
• Sharma, P. (2011). Management of Information Lifecycle, Journal of Engineering and Research Studies, Vol.II, Issue IV, October-December, 2011, pp.15-16.
• Wimmer, B. (2015). Business Espionage: Risks, Threats and Countermeasures, Butterworth-Heinemann, Oxford.

DISCLAIMER: All information presented on ForewarnedBlog is intended for general information purposes only. The content of ForewarnedBlog should not be considered legal or any other form of advice or opinion on any specific facts or circumstances. Readers should consult their own advisers experts or lawyers on any specific questions they may have. Any reliance placed upon ForewarnedBlog is strictly at the reader’s own risk. The views expressed by the authors are entirely their own and do not represent the views of, nor are they endorsed by, their respective employers. Refer here for full disclaimer.