Tailored Solutions & Consulting, Inc. (TSC) was founded in 2006 as a response to the limitations of traditional security vendors who are failing to incorporate the need for proactive and holistic solutions in combating security threats to enterprises. We are an enterprise security provider specializing in the protection of trade secrets, intellectual assets, and other sensitive information using a patented methodology that holistically optimizes clients’ security posture to suit their unique organizational, procedural and market environments.
Headquartered in the Glover Park neighborhood of Washington, D.C., TSC’s global team brings together intelligence operations and analysis, business acumen, and agile technology solutions to meet the needs of a wide range of industries and organizations, from the Fortune 500 to smaller start-ups to U.S. public sector programs. Our proven delivery of proactive holistic security solutions makes us a uniquely trusted and qualified partner in resolving clients’ most complex and intractable challenges.
In a complex world growing with sophisticated cyber attacks and threats from insiders, all organizations must be proactive in the defense of their sensitive information. From corporate intellectual property and trade secrets to protected health information, we have innovated an approach to enterprise security that can help secure organizations across all industries.
Our proactive approach examines holistic vulnerability across six critical domains of an organization with the intent of reducing risk and preventing an incident from occurring in the first place. Using unparalleled expertise and decades of combined experience understanding technical and human threat, TSC better safeguards client value, innovation, and reputation.
Unlike other providers, our specialized methodology and credentialed staff have the expertise to examine threats and risk-based behaviors emanating from the human being, whether those actions are deliberate, such as the placement of a competitive intelligence adversary inside your enterprise, or inadvertent, such as from a trusted insider.
Focusing on travel security and policies such as Bring Your Own Device (BYOD), we apply our patented process to protecting sensitive data while in transit – often times when intellectual assets, trade secrets, and other protected information are at their most vulnerable.
The standard "guns, gates and guards" approach can enhance employee safety and provide protection from external threats. But often times this creates complacency. And complacency breeds vulnerabilities that can be exploited. Our unique process considers threat vectors to physical security utilizing highly specialized expertise that examines risk from the adversary perspective.
Surprisingly, most organizations have difficulty agreeing on what data they possess is their most valuable. If it isn’t clear what is sensitive, how can effective security in its defense be achieved? Furthermore, what preparation has been done to ensure continuity of operations in the event of a data breach, whether in the form of a cyber incident or an insider threat?
Despite your best efforts, cyber threats continue to defeat traditional defenses, often without being caught for days, weeks, or months. TSC's proactive cyber risk management program focuses on current enterprise vulnerability in order to reduce the chances of a security incident from occurring in the first place.
In every industry and type of organization, external relationships such as partners, suppliers, and joint ventures bring additional risk. These entities demand vigilance, especially in overseas settings where government-mandated partial ownership can expose intellectual property or trade secrets.
Our patented Threat Vector Manager ™ (TVM) is a knowledge management process that identifies trends, patterns, and areas of elevated risk in order to prevent and reduce the inadvertent disclosure and/or compromise of sensitive information.
Designed to meet or exceed numerous national and international industry standards including NIST, ISO, SANS, COBIT as well as proprietary subject matter expertise, TVM™ provides an objective perspective not normally explored: real-time modeling and integrated data enabling for a comprehensive, proactive awareness of global enterprises and identification of emerging threats and risks. This methodology identifies best business practices, improves performance and decision-making, and informs resource allocation based upon risk sensitivity and exposure.
TVM™ helps maximize clients’ return on security investments by delivering objective intelligence and practical solutions to FIND, FIX, and PROTECT the most critical problem areas.
Baseline measurements of holistic vulnerabilities across threat vectors with our unique Enterprise Security Assessment and External Relationship Mapping solution
Comprehensive assessment of client-specific risk that measures policy maturity, procedure, and governance of intellectual asset defense in conjunction with critical business needs
Specification of resources required to more effectively remedy significant risk exposure, giving decision-makers ultimate control over outcomes
Creation of targeted security initiative and implementation of improvements for priority vulnerabilities, based on level-of-effort and source-needs calculations
Subscription via a highly secure, encrypted cloud portal or local host for periodic reevaluations and illustration of impact of additional security initiatives
Secure intelligence delivery via a customizable Executive Dashboard tailored to each client, including such sources as DLP, MDM, and SIEM data, as well as social media and RSS feeds
Ongoing assessments of evolving threats, vulnerabilities, and consequences for critical assets, along with continuous improvements
Integration with any vendor's security sensors already owned by the client, to leverage existing investments and position them for optimization
Lloyd’s of London Insurance Product to Integrate TSC’s Holistic Risk Assessment Methodology with New Cyber Security Policy for U.S. Energy Industry
Washington, D.C. - based Tailored Solutions & Consulting Inc. (TSC), an innovator in enterprise security intelligence specializing in intellectual asset and trade secret protection, today announced the integration of its patented Threat Vector Manager™ (TVM) platform with a new cyber insurance policy for U.S. critical assets led by Lloyd’s of London.
“As discussed in Executive Order 13636, the cyber threat to U.S. critical infrastructure represents a growing and persistent challenge to the national and economic security of the United States,” said Sean Doherty, President of TSC. “As a first of its kind, we are excited to pioneer incentives for private industry’s partnership with public sector cyber security initiatives. Our platform provides insurance underwriters a means to reliably and accurately determine the cyber risk class of U.S. critical assets using our objective, standards-based methodology for assessing holistic enterprise security.”
TSC’s platform will assist London and international underwriters to optimize their pre-binding process through incorporation of TVM’s™ Enterprise Security Assessment component. TSC’s methodology is trusted to deliver objective, baseline measurement of holistic vulnerabilities across six domains while examining threat vectors both internal and external. With TVM™, underwriters will be afforded contextual awareness of the potential insured’s security posture — not a mere audit — as well as a clear understanding of strengths, weaknesses, and associated risks of loss.
“In an age of growing and sophisticated cyber attacks as well as threats emanating from insiders, it is essential all organizations ensure a proactive and holistic approach to their security,” Doherty said. “Rather than spending money on theory, companies will be receiving objective, real-world risk assessment that will enable them to obtain appropriate insurance for their particular risks, and thereby reducing the cost of implementing Executive Order 13636 and PPD-21,” he said.
TSC Director of Security Intelligence Reminds Audience of the Dangers Posed by Insider Threats
Washington, D.C. – Tailored Solutions & Consulting (TSC), an innovator in enterprise security intelligence specializing in intellectual asset and trade secret protection, has announced that TSC’s Director of Security Intelligence addressed an audience of legal experts, business leaders, and other stakeholders at the Intellectual Property Owners Association annual meeting in downtown Boston, MA on 17 September 2013.
During the keynote panel presentation with in-house counsel and experienced practitioners from Ford Global Technologies LLC and the U.S. Department of Justice’s Computer Crime and Intellectual Property Section, TSC’s director offered the audience practical advice for preventing and addressing trade secret theft in an age of growing and targeted threats to corporate value.
“The decision of whether to protect innovation via patent, trade secret or otherwise is almost entirely separate from that of effective security. An adversary doesn’t care about what legal category their desired target information falls under, only if they can get access to it,” said Mark Lopes, TSC’s Director of Security Intelligence.
“Paranoia is part of good business practice as long as it does not impede efficiency or disrupt innovative culture,” he continued. “You should always assume somebody wants your company’s most sensitive information simply because of the current or potential future economic value it represents. To assume everyone will respect ownership rights is not only naïve, it could also mean corporate suicide.”
Distinguishing between TSC and other security firms who only apply cyber-centric or software solutions to enterprise security challenges, Lopes reminded the audience that most threats actually originate from human beings within organizations and not from external and distant hackers.
“We continue to see a vast amount of security resources being poured into purely IT and cyber solutions while the vast majority of data shows that most intellectual property and trade secrets are compromised via insider threats,” he said. “While investment in IT and cyber is important and can help prevent the remote theft of corporate secrets, it does very little to deter, detect and prevent the more prevalent source of theft: someone within your own corporate ecosystem. This is what we focus on at TSC.”
TSC Expert: Platform Complementary to Executive Order 13636; Highlights U.S. Government’s Commitment to Value-based Cyber Programs for Private Sector
Washington, D.C. – While U.S. Executive Order 13636 represents a new policy emphasis on public and private sector coordination on cyber threats, the FBI’s recent launch of iGuardian is a complementary initiative dedicated to the mutual benefit of government and industry. It is a mechanism designed to expedite and augment the cyber security dialogue between private industry and the FBI. It also extends to private industry actors that are not officially designated as critical infrastructure, which is the primary scope of E.O. 13636. More importantly, however, it demonstrates the FBI’s commitment to establishing cyber programs that create value for participating US businesses.
While not a replacement for corporate security investments, iGuardian is intended to transform cyber partnerships into enabling proactive and preventative postures. For example, it is intended to facilitate assessments of sophisticated cyber adversaries within and across sectors, aimed at exposing shared as well as unique cyber threats and vulnerabilities. Rather than evaluating cyber threat data from an exclusively enterprise-centric view, this portal will assist FBI’s generation of crosscutting examinations that result in improved cyber awareness and ultimately the dissemination of actionable information to private industry. In short, it enables industry to benefit from the skills and expertise of US Government cyber technologists, while still maintaining and tailoring enterprise cyber investments.
Collaboration between the public and private sectors is requisite to the defense of US economic ingenuity. Neither sector in isolation has at its disposal the depth and breadth of skills, resources and information required to stem the tide of cyber attacks. In the cyber realm, national security concerns and economic interests are interleaved, as is public-private sectors’ interest in defense of American cyber posture.
“Participation in programs such as iGuardian will enable industry trailblazers to shape the scope and outcome of this nascent mechanism for dialogue with the US government – assuring it meets the bottom line needs of the US commercial sector and the Executive Branch,” says Natalie Lehr, TSC’s co-founder and Director of Analytics. “It is a critical step in exposing the barriers and tackling the uncertainties surrounding cyber risk and federal dialogue with private industry,” she said.
Washington, D.C. – Tailored Solutions & Consulting (TSC), an innovator in enterprise security intelligence specializing in intellectual asset and trade secret protection, has announced that TSC’s Director of Security Intelligence addressed an audience of business leaders and security experts at the Licensing Executive Society Conference in Boston, MA on June 18th.
During a panel presentation on the topic of protecting sensitive data such as intellectual assets and trade secrets, TSC’s director offered a suggestion as to how U.S. companies should understand the growing phenomenon of corporate espionage directed against them.
“Instead of looking at this issue from a moral standpoint, it is better to understand why this issue is occurring from an economic perspective,” said Mark Lopes, TSC’s Director of Security Intelligence. “Why would a competitor choose the longer, harder, and more expensive path to value creation when they could simply steal it from you with the click of a mouse or through a well-placed insider?”
In response to a proposed question concerning effective BYOD policy development, Lopes highlighted the growing challenges companies face while trying to maintain the right balance between information security and employee productivity as wrought by the ubiquity of mobile devices. “At TSC, we tell our clients that access control is the key to preserving intellectual property as it pertains to BYOD,” he said. “From this standpoint, we believe that access to information on devices such as personal tablets and phones must be limited to information that a company would feel comfortable losing in the event of a security incident.”
A lot of people have been asking us about ThreatLAB2014. Slots for attendance have been filling up fast and we are hard at work developing the exciting scenarios for the interactive portion scheduled for day one. In case you haven’t heard, the ThreatLAB2014 event will highlight the complex threats facing U.S. innovation. It will be a combination of traditional keynote speakers and panel discussions coupled with interactive scenarios during which our attendees will have the opportunity to learn critical intelligence techniques to better understand holistic vulnerabilities associated with corporate espionage incidents impacting three fictional companies. (Spoiler alert: the vulnerabilities are not just limited to the traditional “cyber” threat and ALL could have been avoided had there been an emphasis on being proactive rather than reactive.)
In fact, the real reason why we at TSC (along with our partners) came up with the ThreatLAB 2014 concept was because we needed a fun and interesting way to tell the market what we have been saying since our founding in 2006: cyber-centric solutions are fundamentally limited when it comes to responding to cyber threats. This is because isolated investments in expensive technology hardware and software ignore the role of people and processes. What about human behavior inside an organization (think insider threat)?; Or the role of external dependencies, such as suppliers, sub-suppliers, or contractors (think the Target breach)?; Or even the financial and business constraints affecting security investments (think every organization everywhere). This is why we advocate a holistic approach to risk assessment – one that is “proactive” at its core and that considers the evolving risks in dependent business functions. It also can deliver a more cost-effective and more resilient approach to security that explores all the internal and external forces affecting a security posture.
For our ThreatLAB 2014 keynote, we are lucky to have John Powell, who was the general counsel for American Superconductor Corporation (AMSC) in 2011 when the company fell victim to a devastating corporate espionage event where an employee – in exchange for an apartment in Beijing, $1.7 million, and gifts for his girlfriend – sold out his company by providing AMSC’s competitor with crucial source code relating to its proprietary wind turbine technology. As a result of this insider threat, AMSC’s market capitalization was reduced by 90 percent, its annual revenue plummeted by 75 percent and its workforce was decimated by 70 percent. John’s presentation, “Sinovel Trade Secret Theft: Case Study of AMSC’s Successful Litigation and Conviction After Purported Chinese Corporate Espionage of AMSC Trade Secrets,” will serve as a valuable, albeit somber learning experience for ThreatLAB 2014 participants as they begin to transition to problem-solving mode and start the scenarios.
This is going to be an awesome event. Did I mention it is going to be in Las Vegas and that accommodations at the amazing Monte Carlo Resort & Casino are covered for participants? This is one event you don’t want to miss.
Over the past few years, traveling around the country and talking to companies about industrial espionage has proven to be an enlightening experience. I’ve met aspiring entrepreneurs, Fortune 100 executives and everything in between. Some companies I’ve met have been so paranoid that they refuse to even consider overseas operations; while others are so naïve that they think it could “never happen to me”. Sadly, I can count on one hand the number of companies that are 1) both aware of the threat and 2) taking appropriate steps to safeguard their confidential and sensitive information.
The degrees of denial are sometimes overwhelming. Frequently, the legal representative in the room chimes in about how litigation is the key to successful IP protection. Almost as often, I will hear from the IT rep about the latest and greatest firewall that was recently installed that now “fully protects” all of their intellectual assets. Both camps could not be farther from reality.
In the beginning, it was often a challenge to overcome every objection because each party had a natural and vested interest in thinking that they weren’t the department charged with protecting the company’s intellectual assets and other sensitive data (this was sometimes in contradiction to the opinion of the C-Suite, which had the opinion that a particular department was in fact the LEAD in protecting intellectual assets). That is, until one day I realized there was a universal way to describe the problem that all functional areas and levels of an organization could relate to: basic economics.
Imagine two groups of kids putting lemonade stands on the street corner for an afternoon.
|Start-Up Costs (R&D)||
|Break Even Sales||
Group 2 has significantly lower start-up costs, meaning they can enter the market with a 20% pricing discount and still reach profitability almost 2x faster than their competitor. What company wouldn’t take that?
This may seem overly simplistic, but it is this exact example that has had, by far, the most impact with the companies whom I have had the pleasure of speaking. Everyone can see the clear economic benefit to Group 2 by skipping the R&D phase. The IT department realizes that the theft of IP doesn’t need to go through their firewall. The General Counsel realizes that not all theft is easily proven and litigated against. And the CFO in the room sees the clear financial stakes of not protecting sensitive information.
I vividly recall one particular California executive took umbrage with my talking points about overseas industrial espionage and indicated it was nothing more than the current scare tactic of the day. No more than two weeks later, a report by a respected publication came out detailing pervasive and irrefutable evidence of concerted overseas efforts to acquire US technology. I’ll never forget the call back from this executive asking if we’d come in and take a look at their current security posture.
It shouldn’t take a publication to prove to US companies that economic espionage is occurring; it’s just basic economics.
What is BYOD? Glad you asked. Today’s employees are investing their hard earned paychecks in mobile computing devices that are newer, smaller, more powerful, and more productive. These devices are evolving at a pace faster than most companies are updating their computer hardware. Employees expect to be able to do their work on devices that are at least as fast and capable as their personal devices. In order to avoid obligatory hardware refreshes on a yearly basis, companies have sought less expensive alternatives.
Bring Your Own Device, or BYOD, is the latest evolution in the new distributed network model revolution that began with cloud services. In a nutshell, BYOD means employees bring their own devices to the workplace and use them throughout the course of conducting business. Employees utilize their personal devices to access customer/prospect data, send emails and engage in a host of other activities/tasks. For those of us (I am guilty) who miss the good old days of secure devices operating on secure networks, BYOD can foster some debate. How can a company expect to retain control of its intellectual property when it is floating in a cloud, readily accessible by employee’s personal devices?
BYOD exists at your company, with or without your blessing, acknowledgement, or approval. As a result, your organization may be reaping benefits such as cost reduction, improved productivity, and employee morale. However, without a BYOD policy, you are putting your organization and its intellectual assets, trade secrets, and other proprietary data at risk. So the question isn’t “IF” you should adopt a policy but “WHEN”.
The answer to this question is simply – “ASAP”. A well-crafted BYOD policy should be implemented immediately. And it should maintain pace with current technology as well as in an intelligent and methodical manner that will provide employees with benefits while ensuring your intellectual property remains secure.
Key components of a BYOD policy:
When you read the morning newspaper, daily articles detail the latest intellectual property, trade secret or personal information theft from commercial and government entities. On the commercial front, the stories primarily focus on high technology or financial institutions (such as Google or J.P. Morgan). Theft from manufacturing companies is often ignored. It is here where some of the most significant IP and data losses occur and often go unnoticed for months or years. Losses typically go undetected until a competitor comes out with a product that “looks just like “x” product” that was being produced by the targeted company(s).
Manufacturing companies produce a wealth of IP and innovation. However, the public and media (as well as the companies themselves) have been slow to recognize the threats. In order to effectively combat these threats, manufacturing companies must first identify the IP and data that represent the lifeblood of their organization. Second, they must understand how it is potentially at risk.
They must establish effective processes and procedures to safeguard their IP and data. It’s critical to institute monitoring technologies such as data loss prevention (DLP) tools and digital rights management tools. Additionally, employees need training and awareness programs to help them understand both the significance of IP and data protection and “how” they should both handle IP and data and report potential security violations.
The major issues common to classic manufacturing companies are:
These are just some of the challenges that commercial manufacturing entities face. TSC is helping this significant and perpetually emergent manufacturing base acknowledge the threat to their sensitive IP and data sources and to implement protection measures to ensure these companies retain their industry advantages.
The presence of fortified security in the form of gates and guards offers false hope to companies looking to protect their sensitive data. While physical security is undeniably an important element of deterrence, it should never be regarded as the sole antidote in preventing compromise to intellectual assets and trade secrets. In fact, no single component of enterprise security ever provides complete protection in an age of sophisticated and persistent threats to sensitive data. Security solutions must be as diversified and resilient as the very threats that are targeting you (not trying to scare you, but you are probably in possession of information that somebody wants).
One way to begin an effective IP protection strategy is through employee education and awareness. Employees are on the front lines. They are your human resources specialists, your administrative staff, your operations and sales people, your information technologists, and your research and development team. The scope is boundless. What likens these seemingly unrelated groups is that they all have access to sensitive information – from knowledge of competitive processes and trade secrets to patents, trademarks, and copyrights – that directly contributes to your differentiation and thus your ability to create and capture value.
Yet, the question remains: are these employees aware of the value of the information they possess? Do they understand what information is considered more valuable than others? Furthermore, are they cognizant of the vital role they play in protecting it? In all industries and in all organizations, the need for employee security awareness, effective education, as well as data classification and loss prevention are critical to the safeguard of sensitive information. In this regard, a Fortune 500 company is no different than a state health exchange or a major public university. The reason? All three organizations have information that they are obligated to protect. For the Fortune 500 Company, it is trade secrets and intellectual assets. For the state health exchange, it is electronic protected health information covered under the HIPAA Security Rule. And for higher education, it is personal identifiable information protected under FERPA guidelines as set by the U.S. Department of Education. What unifies these organizations is their requirement to secure information that must be protected – because a failure to do so may result in significant value degradation or even administrative and financial penalties imposed by regulatory authorities, such as the U.S. Department of Health and Human Services.
So what are some classic examples of poor employee awareness and education? Take for example a common theme among organizations with robust physical security programs, such as a gated campus, visitor access control, and security patrol. At such a place, employees may develop a sense of false security and neglect basic security measures out of the belief that the onus is not on them, per se, but rather “the security folks” who probably “got it covered”. The employee may not even think to question the presence of a stranger (or a known colleague) within a sensitive area – such as a server room or an area where key R&D takes place – because of a mistaken assumption that the person probably “belongs.” But that is a dangerous assumption to make. The rise in sophistication of intellectual property theft – even from Insider Threats (http://goo.gl/jeQmcE) demonstrates the need to equip employees with the knowledge of the complexity of threat directed against them and how it does not matter if a particular component of their enterprise – such as physical security – is well fortified. If an adversary is determined enough, they will certainly pivot and exploit the vulnerability left undefended.
Educating your employees on what constitutes “valuable” as well as the tactics that may be used to pilfer data can offer a proactive step in fortifying your enterprise against IP and trade secret theft. At TSC, we specialize in a holistic approach to enterprise security that seeks to understand vulnerability being created by six critical domains across your organization – whether private or public sector – in our unique approach to IP and trade secret protection. But make no mistake: the front lines of protection rests with the human front lines of defense (and that’s everybody who works for you).
“The willingness of US scientists and scholars to engage in academic exchange makes US travelers particularly vulnerable not only to standard electronic monitoring devices—installed in hotel rooms or conference centers—but also to simple approaches by foreigners trained to ask the right questions.”
“If a company has significant intellectual property that the Chinese and Russians are interested in, and you go over there with mobile devices, your devices will get penetrated.”
These quotes are indicative of the risks to intellectual property that US businesses face everyday when traveling overseas. So what is the best strategy to use if you want to show a prospective client your capabilities and how your company is the right solution for them? How do you separate yourself from competitors while simultaneously protecting your intellectual assets?
Before I do, here are a few examples of intellectual assets that we unknowingly possess while traveling overseas that could prove extremely valuable to an adversary:
Here are a few practices to minimize information loss while still allowing you to have a successful trip abroad:
The truth is there is no simple solution to completely eliminate the possibility of corporate espionage or deterring an adversary from stealing your intellectual assets. However, making an effort to constantly improve employee awareness and guidelines while traveling overseas will lead to successful trips and the protection of valuable intellectual assets. Please give us a shout if you have any questions on how TSC can assist in your development of an effective mobility policy.
For six long months, you’ve worked a lot of overtime to earn a little extra money so you can treat your family to a theme park vacation. Eventually, you reach your financial goal, pick up the amusement park tickets and take out some cash for the surprise trip. But first, you take your family out to dinner to celebrate. After relaxing, all seems right in the world. However, things take a drastic turn for the worse when you return home. Your state-of-the-art security system has been disabled. You find yourself in a momentary state of confusion as you recall having turned it on before leaving. There are no broken windows, all your doors are locked from the inside and you find no evidence of forced entry.
As you frantically scour the house, it appears as though nothing has been taken or damaged. Then it hits you: there IS one thing that may be missing. You race to the locked cabinet, and frantically open it. With one glance, your heart drops. The envelope with the amusement park passes, cash, and airline tickets are gone. Six months of effort squandered. In a matter of hours, someone completely unraveled everything you had been working towards.
After surveying the damage, you transition into “problem-solver mode.” You vow that this will never happen again. You install floodlights and motions sensors. A new, six foot fence encompasses your property and two large Doberman’s prowl within. You upgrade the alarm system. Your window and door locks are now top of the line. And finally, you replace the locked cabinet with a Class TXTL-60 safe that can withstand explosive charges. You have hardened your defenses from the outside in, thus ensuring that your hard work and family dreams will never be taken from you again.
Unfortunately, you are no closer to being safe than you were the moment you left for that family dinner. Why?
You have applied sound, robust and proven tactical solutions to an overwhelmingly strategic problem. You failed to recognize that the real issue was not the theft of your vacation envelope but HOW the thief knew it existed. You upgraded a safe in order to prevent easy entry, but you still don’t know how the locked cabinet in your home office was so easily identified as holding the prize. You improved the features of your alarm system without addressing how the deactivation code was compromised last time. Your dogs now prowl and protect your exterior, yet it remains unclear how the initial entry was made. In essence, you’ve improved your security marginally (if at all), while simultaneously highlighting to any previously unwitting bystander that there must be something valuable to protect inside. Otherwise, why would you spend precious family resources on all of these security upgrades? Perhaps instead of being the target of one professional thief, you’ll now be the target of an additional few who are willing to chance the security for the assumed windfall inside. And worst of all, you’ve created a false sense of security for yourself and your family.
You would never expend funds unless you were sure it was addressing the problem. Unfortunately, these are the mistakes that countless U.S. corporations – from start-ups to Fortune 100 companies – are making daily in response to a systemic problem of intellectual property and trade secret theft. Tactical solutions such as the latest and greatest anti-virus program and physical security upgrades are often viewed as adequate countermeasures against leakage of sensitive corporate information. In an effort to prevent the next theft, they are failing to understand the root cause that may lead to 100 more thefts down the road. How did these bad actors know where to find your sensitive information? Who told them a product was moving from R&D to Pilot phase? How did the information get through the strong internal controls? Was an insider involved? Did someone in the corporate ecosystem such as a supplier, joint venture or partner gain access to the information? Is this part of a larger concerted effort against your organization?
No one should tell you that a tactical solution would not be a part of a broader security strategy. There is often a significant overlap. Holistic solutions include proper IT protection, travel security and basic physical security safeguards. However, your corporate IP thief is banking on the fact that every U.S. corporation will stop its protection efforts there. And most importantly, they are counting on the fact that human nature will stay true to form and a false sense of security will envelop the organization as people see the enterprise protection efforts in place. The only state of an enterprise more attractive to an IP thief than complacency is denial.
Maintain hope. There is no cliff to dive off. There is no such thing as an insurmountable enemy. The American spirit is based on the belief that a large challenge is simply a great opportunity to conquer. It is important to understand the root causes of our current challenge. We must focus our precious corporate resources on not just stopping an ongoing issue but knowing how it was perpetrated and learning from it in order to prevent the next one. Through increased awareness and attention, corporate leaders have taken the important first steps in getting a handle on this acutely imperative issue. How this issue is addressed will define whether we continue to lead the world in innovation for generations to come or succumb to the economic realities of constant competition against entities that have built their success upon our shoulders.
$300 billion annually.1 Increasingly, American companies are facing persistent threats to the integrity of their business activities and are grappling with how to stem the erosion of their value due to commercial espionage as perpetuated by foreign and domestic actors. In addition to the harm this causes the affected firm, these thefts also contribute to American job loss and a decline of the U.S. economy as captured in GDP terms. In some cases, this has resulted in the permanent ceding of American ingenuity to rivals who are not only stealing the intellectual property (IP), but also counterfeiting and adapting it to foreign markets by focusing on low-cost positioning and mass consumption and subsequently evolving into market disrupters in their own right.
These challenges are consistent and costly. Since 2010,cyber espionage attacks - for the purposes of stealing American intellectual property – have risen 38% with the average cost to the victimized firm representing approximately $8.9 million per year.2 And with an estimated 80% of corporate value tied to these intangible assets,3 the potential for extraordinary loss is evident.
So what should U.S. companies do to protect themselves from this threat? Although investments in defensive measures such as firewalls or anti-virus solutions are popular tools for securing intellectual property, it ignores the fact that vulnerability emanates from other access points into an organization. In an age of growing and sophisticated attacks, particularly as related to the state sponsorship of IP theft through cyber and insider threats, firms must ensure security investments are diversified across their entire business enterprise.
But what does that mean? It is not to say that security investments in specific components of an enterprise do not provide protection. They can. The problem is that a single faceted approach is insufficient and incomplete.
Take for example, security boutiques specializing in cyber defense (and offense). These firms will gladly sell their products and services as the panacea for total security and protection, but vendors specializing in these services tend to offer a reactive approach rather than a proactive one and only focus on domain-specific areas of an organization. Most times, their services are only utilized after a security incident has already occurred and where an erosion of value, innovation, and reputation has already been inflicted. Additionally, introducing additional infrastructure may also create more complexity as well as data that inevitably may be left unanalyzed and uncorrelated to other threats being introduced from other ingress points into the enterprise. Although application behavior, system performance, user actions, malware activity, APT, and other deceptive activity are critical data streams in any post-incident assessment, a cyber-centric approach to security such as this lacks the capability to corroborate vulnerability from elsewhere within the organization, and is devoid of the fundamental philosophy that a proactive and holistic methodology could have prevented an incident from occurring in the first place.
For companies who rely on ‘in-house’ personnel to meet their security needs, the basic problem remains the same. Although some organizations prefer this solution due to a fear of revealing vulnerabilities to outsiders, these personnel tend to focus only on diagnostics, forensics, and security monitoring. Often times – and because of the nature of their employment – these staff members may not be able to offer an objective assessment and lack the true investigative and analysis expertise to ‘connect the dots’ across the entire enterprise.
For this reason, instead of focusing on security solutions in just one component of an enterprise, the more prudent approach to enterprise security is a holistic intelligence program diversified across the entire organization practiced by the right experts. This can offer a trusted way for firms to protect their intellectual assets and other sensitive data in an age of sophisticated threats. “We are suggesting that a ‘big picture’ approach to security is a better way for organizations to understand their threat landscape,” said Mark Lopes, TSC’s Director of Enterprise Security Intelligence.
Holistic Security: A Deeper Look
At TSC, we define holistic security as encompassing six basic functional units and processes of an organization: Mobility, Data Security, Physical Security, Insider Threats, and Internal/External Business Operations, which includes joint venture and supply chain risk management. It is based on the premise that so-called ‘isolated incidents’ of vulnerability occurring in one area of a business should be juxtaposed with structured and unstructured data being produced from other areas as a means to deeper understand and identify threat and possibly corroborate other vulnerabilities and negative trends using similar methodologies. So what can these isolated incidents look like? The below example demonstrates how four separate incidents – when interpreted holistically and proactively - could have assisted skilled experts understand the nature of a threat directed against a company’s valuable data.
Isolated Incident #1:
The IT Department observes Employee #1 trying to gain access to a folder for which he/she lacks permission. This folder contains sensitive information on a prototype development not yet introduced to the market. A week later, this same employee was observed running a scan of the company’s internal network. When IT staff notice this activity, they confront the employee however a reasonable explanation was provided and no subsequent action was taken. This information was not shared with any other department within the company.
Isolated Incident #2:
The office manager notices Employee #1 working late hours, an irregular and seemingly unnecessary activity given this employee’s position and job title. Late one evening, Employee #1 attempts to leave the building with a bag containing folders labeled, “proprietary.” When the office manager questions this activity, the employee offers a frantic apology and a plausible explanation. Accepting this response as legitimate, the office manager does not share this information with anybody else inside the company.
Isolated Incident #3:
A different employee, Employee #2, travels overseas to attend a meeting with a foreign partner on a joint venture (JV) opportunity. During the trip, the employee travels with both his smartphone as well as a company laptop containing proprietary information. This is because the employee’s company did not establish security policies and procedures covering Mobility, which covers Bring Your Own Device (BYOD) and foreign travel. Additionally, on more than one occasion, Employee #2 accesses his company’s network from the partner’s internal network. Not thinking anything of it, Employee #2 does not mention this activity to any of his colleagues upon his return.
Isolated Incident #4:
At lunch on a Monday morning, colleagues learn Employee #1 just returned from a weekend trip overseas. When asked about it in detail, the employee offers a hurried and confusing explanation about a ‘weekend getaway’ that appeared to be in conflict with the established lifestyle pattern of this person. Later that day, colleagues learn that Employee #1 traveled with numerous company thumb-drives and disks – more evidence of unusual behavior for a traveler supposedly on vacation from work. Over time, colleagues begin to notice Employee #1 exhibiting unexplained affluence. For example, they observe him driving a brand new car rather than the more modest vehicle he usually drives. When asked by a colleague, the employee stated sheepishly the car was a gift from a distant relative. Without additional information confirming suspicions, the issue was dropped and this information was not shared with anybody else inside the company.
As individual data points, the preceding incidents could be interpreted as mundane and ordinary. But if these events were documented, and if they were correlated and analyzed proactively by the right experts with information collected from other departments, certain patterns could begin to emerge that would confirm the presence of holistic vulnerability emanating from Insider Threat and Mobility – and possibly prevent the threat from materializing in the first place. Whereas Employee #1 was demonstrating behavior of a classical malicious insider, Employee #2 served as an example of the need for organizations to codify security policies and procedures relating to Mobility and the role employees must play in safeguarding critical information.
“It takes the right professionals with the right backgrounds to be able to correlate, analyze, and investigate the types of complex and disparate data sets that ultimately serve as potential threat indicators to companies,” said Sean Doherty, President of TSC. “This is our core competence.”
TSC Threat Vector Manager ™
As an innovator in enterprise security intelligence, TSC specializes in the protection of intellectual assets and trade secrets using this very unique holistic approach and other innovative techniques. Using its patented Threat Vector Manager ™ (TVM) platform, TSC experts integrate and correlate an array of internal and external data sets from six fundamental domains and provide actionable recommendations to fix problems across an enterprise while delivering ongoing vulnerability protection. Based on the threat vectors being investigated, TVM™ establishes baseline threat and vulnerability metrics and creates a threat assessment review. Actionable recommendations are then created to mitigate identified threats and a plan for delivering ongoing intelligence to prevent future losses is developed.
Some additional benefits of TVM™ include:
In an era of sophisticated threats, intellectual asset and trade secret protection is best achieved through a holistic approach utilizing trusted intelligence methodologies practiced by the right experts. Based on business priorities, available budget, and resources, TSC offers cost-effective and comprehensive security programs necessary to find, fix, and protect critical security vulnerabilities. ”Failure to address the challenge of trade secret theft costs industry billions of dollars each year,” said Pamela Passman, President and CEO of CREATe.org, a leading non-profit dedicated to helping companies, suppliers, and business partners reduce piracy, counterfeiting, and trade secret theft. “[It] can have devastating reputational, financial, and legal impacts for individual companies and the global economy as a whole.”
About the Author
Armond is a Senior Threat Specialist at TSC and is based in Washington, D.C. He joined TSC in 2011 and has managed global projects as well as specialized training and awareness programs focusing on threat analysis and intellectual asset protection for both the private and public sector. He holds a Master’s degree from the Fletcher School of Law and Diplomacy at Tufts University and a Bachelor’s degree from the University of New Hampshire.
About Tailored Solutions and Consulting (TSC)
TSC, an innovator in enterprise security intelligence, specializes in the protection of intellectual assets and trade secrets. Employing a holistic approach, TSC identifies and protects organizations’ critical and valuable intellectual assets against insider threats, supply chain risks, cyber security vulnerabilities, mobility, and physical security risks. Using patented methodologies through its Threat Vector Manager™ framework, TSC leverages its analytical and investigative expertise, diverse language skills, and global experience from work in the public and private sectors to provide customized solutions to members of the Fortune 500, innovative start-ups, and the public sector. For more information, please visit us at www.tscadvantage.com.
1. The Securities and Exchange Commission is currently reviewing its guidance to companies on regulatory disclosure obligations, as companies who have been the victims of cyber attacks and other events with potential for value degradation are either not reporting or underreporting their victimhood in their annual filings. Nowhere was this more evident than in the case of Coca-Cola. In this example, the cola giant experienced a significant data breach in 2009 at the hands of Chinese hackers who successfully pilfered intelligence information on the brand’s attempted $2.4 billion acquisition of juice manufacturer China Huiyuan. It was not until years later that Coca-Cola officials publicly revealed this information.
The Canada Revenue Agency (CRA) has fallen victim to the “Heartbleed” bug. Andrew Treusch, Commissioner of Canada Revenue Agency (CRA), said government security agencies notified his office “of a malicious breach of taxpayer data that occurred over a six-hour period” last week. Someone exploiting the Heartbleed vulnerability stole approximately 900 social insurance numbers from Canadian taxpayers. Federal police are investigating and government officials are “analyzing other fragments of data, some that may relate to businesses, that were also removed.”
Chicago-area doctor’s group Midwest Orthopedics said in a news release that the surgical information for more than 1,200 patients may have been compromised in February when an unknown person accessed a doctor’s Gmail account. While it is unclear whether or not the information has been misused, all patients have been notified.
Journalist Barrett Brown, who originally faced multiple federal charges for sharing a link to credit cards numbers in the breach of intelligence firm Stratfor, has pleaded guilty to two federal charges. Brown, a public face of hacking group Anonymous, will admit to serving as an accessory after the fact to an unauthorized access to a protected computer and obstructing justice in the execution of a search warrant. He faces another charge related to threatening a federal agent in a YouTube video.
Health services provider Kaiser Permanente has discovered that a server was infected with malware and believes it may have been there since October 2011. Over 5,000 members are being notified that their personal information may be at risk. State and federal authorities have been notified.
An employee of UK supermarket Morrisons has been arrested in the leak of over 100,000 employees’ payroll information. The employee reportedly offered the data to a newspaper and published it on a website. Although the suspect’s motives are unclear, the company has been having serious financial trouble recently.
Unencrypted laptops were stolen from the UCSF Family Medicine Center in a burglary. The personal information (including names, addresses, dates of birth, medical records, health insurance ID numbers and social security numbers) of 10,000 patients has been compromised. All impacted individuals are being notified, and those patients whose Social Security numbers were compromised are being offered credit monitoring services.
Zesa, a Zimbabwean power utility company, has been getting defrauded between $10 and $30 million every month (for several months) by a syndicate involving more than 10 of its employees. Insiders installed prepaid meters without Zesa’s knowledge, giving users free electricity.
A North Dakota University System computer server that stores personal information on students, staff and faculty has been hacked. Personal information, such as Social Security numbers, of more than 290,000 current and former students and nearly 800 faculty and staff were on the server. It appears to be an offshore attack.
Las Vegas Sands has confirmed attackers have accessed sensitive employee and customer information. Compromised in the attack were credit card information or bank account information, social security numbers, driver’s license numbers and other confidential information. Both the FBI and the Secret Service are investigating the attack and Sands is taking steps to protect customers whose information may have been compromised.
Three web crawlers (bots that browse the internet for web indexing purposes) have accessed the personal information – including names, addresses and social security numbers, of nearly 146,000 former and current Indiana university students. An investigation is ongoing. The university is enhancing security to ensure that a similar incident does not occur.
Miami-based chemicals distributor Andes Chemical Corp. and its employee Santiago Blanco, have sued The Dow Chemical Co. over work restrictions they have tried to impose upon Blanco’s work. Andes and Blanco contend that Dow’s restrictions are unjustified because he signed a confidentiality agreement but no noncompete agreement with his contract.
Researchers have discovered a massive network of router exploits (stemming from two London IP addresses) that has compromised more than 300,000 computers. These vulnerabilities have gone unpatched for two years. Law enforcement is currently attempting to trace back the two master IP addresses.
The University of Maryland has been hit by a massive data breach, putting more than 309,000 students, faculty and staff at risk. The breach entails information on any individual issued a campus ID for UMD College Park and Shady Grove campuses since 1998. Stolen data include social security number, name, date of birth and university ID number. According to UMD, no other financial, contact or health information has been compromised.
Popular crowd-funding website Kickstarter has been hacked. Although no credit card info was exposed, other information including usernames, email addresses, mailing addresses, phone numbers, and encrypted passwords may have been compromised. Kickstarter is only the latest company to be targeted by malicious actors – Yahoo, Target and Neiman Marcus have all had customer data compromised over the last two months.
3, 026 clients of Easter Seal Society of Superior California, a charity group serving individuals with special needs, may have had personal information (such as health care provider information, identification numbers and billing information) compromised after an employee’s vehicle was broken into and a work-issued laptop was stolen.
Swiss bank UBS AG has put two bankers on leave as part of an internal investigation into the hiring of a close relative connected to a potential Chinese corporate client. The investigation has inspired investment banks throughout greater China to examine the roles of certain Chinese bankers.
Former State Department contractor Stephen Kim has pleaded guilty to one count of unauthorized disclosure of national defense information (regarding the military capabilities and preparedness of North Korea) to a Fox News reporter. Kim is expected to serve a 13 month term in prison.
White Lodging – a company that maintains Hilton, Marriott, Sheraton and Westin hotel franchises – has fallen victim to a data breach that exposed guests’ credit and debit card information. An investigation is in progress.
A point-of-sale malware operation from the Ukraine has stolen payment card information and personal data from 45 small and midsize retailers. Roughly 50,000 cards were affected. There is no connection between this attack and the breaches at Target and Neiman Marcus.
Orange, a French telecom company, has announced that an attack on its website exposed details for three percent of its customer base.
Yahoo has acknowledged that attackers now own an undisclosed number of usernames and passwords to Yahoo Mail accounts. The attackers likely hacked an external, third-party database in order to obtain the information.
A Hacktivist group known as the European Cyber Army claims that it has waged targeted DDoS attacks against Bank of America and JPMorgan Chase.
The email accounts of three Calif. physicians were compromised in a phishing scam. As a result, the personal information of 1,800 UC Davis Health Systems patients may be at risk.
An IT worker formerly employed by the Korea Credit Bureau has been arrested after allegedly copying names, Social Security numbers and credit card details of over 20 million South Koreans to a USB stick in order to sell the information to phone marketing firms.
Neiman Marcus, a luxury retailer, has confirmed that it has fallen victim to a data breach. The breach may have involved the exposure of an unknown amount of customer payment cards. This comes only a week after Target announced that it was struck by a breach, exposing payment cards and personal data of up to 110 million customers.
Staysure, a British travel insurance company, has fallen victim to a data breach. Hackers stole names, addresses, encrypted payment card details and CVVs. The breach occurred in October, yet it wasn’t detected until mid-November.
4.6 million Snapchat usernames and phone numbers were leaked after anonymous hackers posted the information online. The incident is currently being investigated by law enforcement.
Target has reported that hackers have stolen data from up to 40 million credit and debit cards of shoppers, making it the second-largest breach of this nature reported by a U.S. retailer.
Over 32,000 patients of Cottage Health System in California have had their personal and health information exposed on Google for over a year due to a business associate’s lack of protections for one of its servers.
The Dow Chemical Co. has accused a competitor operating in Turkey and the Netherlands of importing patent-infringing paint polymers into the U.S. and stealing trade secrets from ex-Dow employees.
Crown Castle International has acknowledged a data breach. An unknown perpetrator bypassed Crown Castle’s security system, accessing an e-mail containing an payroll attachment that listed U.S. employee names, Social Security numbers and compensation.
The Vermont Health Connect website has fallen victim to a security breach. In this instance, one user got improper access to another user’s Social Security number and other data.
The personal information of more than 300 employees, former employees and students at Washington State University has been compromised after hard drives were stolen from an on-campus office last month.
Up to 500,000 credit cards were hit by an Ennis data breach – financial information and security codes were compromised. The breach is currently under investigation.
7,000+ patients who received care at University Hospitals of Cleveland are being notified that an unencrypted hard drive containing their personal information and data has been stolen.
A limousine software company has been hacked, exposing the credit card numbers and personal information of close to 1 million customers, including politicians, star athletes and corporate executives.
Adobe has fallen victim to a recent data breach that exposed user account information and prompted a flurry of password reset emails. The breach impacted at least 38 million users. It also appears that the leak includes the company’s photoshop family of graphical design products.
British national Lauri Love has been charged with hacking into the networks of the US Army, Missile Defense Agency, NASA and other agencies. Love and his unnamed co-conspirators stole confidential data between October 2012 and October 2013.
A simple vulnerability in Verizon Wireless’s web-based customer portal exposed subscriber’s SMS message history, including the numbers of the people they communicated with.
A former Broward Health Medical Center employee stole documents containing the personal information of some 960 patients in a data breach uncovered by local and federal officials.
Wall Street broker-dealer Quad Capital LLC has accused a former executive of stealing confidential information from the firm and joining a rival (Tiger Ratan Capital Fund) just days after joining the company.
WhatsApp, a free messaging app, has been attacked by Palestinian hackers. The website was hacked and defaced by a group called the KDMS Team of Palestinian Hackers.
Two former Eli Lilly scientists are facing charges after allegedly stealing over $55 million worth of trade secrets and leaking the information to a rival Chinese drug company.
Adobe Systems has said that hackers accessed personal data for nearly 3 million of its customers. The hackers removed data including customer names, encrypted credit card numbers, expiration dates, and other information relating to customer orders.
Florida’s Holy Cross Hospital recently acknowledged that they may have fallen victim to a data breach. A former employee has been accused of accessing data including patients’ names, birth dates, addresses, and social security numbers.
Internet Explorer zero-day attackers have been linked to Chinese hackers who compromised Bit9 earlier this year. The connection was established through identifying similar malware, IP addresses and email addresses used to register domains.
LexisNexis has confirmed a data breach. The personal and business information collection company is trying to determine whether hackers may have gained access to social security numbers and other details on millions of Americans. FBI is investigating.
Zynga has reached a settlement with ex-employee Alan Patmore over allegations of trade secret theft. Patmore admitted to stealing more than 760 documents after he left for rival social gaming company Kixeye.
LinkedIn users are claiming that the company ‘hacked’ their personal email accounts in order to send marketing information to their contacts.
Former Korn/Ferry International executive recruiter David Nosal recently hacked into the company’s databases. Nosal stole trade secrets such as candidate lists and used the information to launch a competing business.
A Brazilian hacking group has attacked NASA’s website to in order to protest National Security Agency surveillance programs.
Imax Corp. recently sued competing technology company, GDC, for trade secret misappropriation. Imax alleges a former employee stole proprietary technologies and provided information to a Chinese competitor.
Sykipot, an older malware variation, has been reworked to steal data on the civil aviation sector in the US. In the past, Sykipot has targeted telecom, computer hardware makers and gov’t contractors.
A hacker has hit German mobile-phone carrier Vodafone, stealing the personal data of two million customers. Names, bank codes, account numbers and addresses were compromised. The suspect is an insider.
China’s Internet has been hit with the largest DDoS attack it has ever experienced. The attack took down sites like Weibo, Amazon.cn, and the Bank of China. It is still undetermined as to who committed the attack.
Glen Cressman and Jason Vuu, former traders at Flow Traders US LLC, have been accused of stealing valuable computer source code from an automated trading firm. Vuu is accused of then sharing the code with Simon Lu. The pair intended on using the information to start their own company.
The City of Johannesburg has fallen victim to a security breach. Due to a failure to implement basic security measures, residents’ accounts were exposed to fraudsters for years.
Video game development company Riot Games has been breached by hackers. User account data, email addresses, and nearly 120,000 credit card numbers were stolen. This is the second time Riot has been compromised in the past 2 years.
Anonymous hackers have targeted gabonactu.com, a news website that is controlled by the Gabonese government.
The hackers leaked the details of 171 users and the credentials of the site’s administrator.
The Washington Post has been hacked by the Syrian Electronic Army. The group, that supports Syrian President Bashar al-Assad has targeted several other journalism outlets. The Post is currently working to resolve the issue.
The Oprah Winfrey Network’s contract claim alleging Discovery Communications Inc. stole the idea for “therapeutic programming” has been upheld.
Stryker Corp. has won $210 million in a patent suit against rival company Zimmer Inc. Evidence revealed that Zimmer willfully infringed Stryker’s surgical irrigation patents.
PV materials supplier Heraeus wins trade secret theft case against former employee accused of stealing company secrets. The company alleged that Tung Pham had taken highly sensitive trade secrets and altered or removed (without permission) data relating a commercially viable new product.
Five men from Ukraine and Russia have been indicted for charges related to a massive worldwide hacking scheme targeting the networks of major corporations including 7-11, Nasdaq, JCP, Dow Jones and Hannaford. Companies reported $300 million in losses.
OVH, one of the largest webhosting companies in the world, has suffered a multi-stage attack. Hackers compromised the company’s database and gained access to employee VPN credentials and email accounts.
Rex Mundi hackers have leaked sensitive information including the email addresses, names, phone numbers and addresses of 6,000 Numericable Belgium (telecomm company) customers.
The San Luis Resort Spa & Conference Center launched a suit alleging that two former managers violated their employment agreements by conspiring with Wyndham Worldwide Corp. to steal proprietary information in order to gain a competitive advantage.
Taiwanese IP surveillance company Brickcom Corporation has fallen victim to an alleged data breach at the hands of the hacking group Anonymous. Anonymous claims to have leaked a Brickcom customer database.
The Institute for Information Industry, a Taiwanese technology firm, has hit Samsung Electronics Co. with a patent infringement suit, claiming Samsung’s networking systems infringe on it’s network design.
Drug manufacturer Pegasus Laboratories Inc. has filed a suit against a pharmacy that produces custom veterinary medicines. Pegasus claims that the company infringed patents for a drug to treat a nervous-system disorder in horses.
Chinese wind-turbine manufacturer Sinovel Wind Group Co. has been charged with IP theft after allegedly stealing trade secrets (including proprietary source code) from its former partner American Superconductor Corp. Three former American Superconductor employees fed stolen source code to Sinovel employees which resulted in losses of more than $800 million.
Two Johnson & Johnson units have sued Hungarian pharmaceutical company Osmotica Kereskedelmi. J&J intends on blocking the drugmaker from launching a generic version of the drug Concerta.
A Chinese-speaking cybercriminal group has targeted various organizations and a wide range of nation states. According to security researchers, malware called “PinkStats” has been used to target dozens of South Korean organizations.
A federal judge has upheld Advanced Micro Devices Inc.’s suit accusing several ex-employees of stealing confidential files before moving to rival computer graphics company, Nvidia Corp. Speculation remains as to whether or not claims that the workers broke federal anti-hacking laws will be preserved.
Ex-Becton Dickinson & Co. engineer, Ketankumar Maniar, has allegedly stolen millions of dollars in trade secrets from the medical technology company (he downloaded around 8,000 top secret files on to a disposable pen injector). The 36-year-old Indian National reportedly planned to profit from the trade secrets after relocating to India.
Spear Marketing Inc. has filed a suit against ARGO Data Resource Corp., alleging they used corporate espionage to steal proprietary information. Spear accuses Argo of using their proprietary info to launch a competing product and steal their largest client.
Accenture, one of the world’s largest consulting firms, must pay software developer Wellogix $44 million dollars due to trade secret theft. In addition to Accenture being sued for trade secret theft, BP has also been found liable for making sensitive information from Wellogix available to Accenture.
AstraZeneca has sued Actavis Inc. to prevent the drug maker from selling a version of the arthritis drug Vimovo. AstraZeneca claims that Actavis willfully infringed five patents. The company is seeking a permanent injunction.
Texas-based company Touchscreen Gestures LLC has filed patent lawsuits against Hewlett-Packard Co. and Dell Inc., claiming infringement of “single-tap” touch-screen technology.
Medical device manufacturers Stryker Inc. and Smith & Nephew Inc. have been sued by rival company AngleFix Tech LLC. AngleFix alleges that the two companies infringed a patent for a bone plate apparatus used in orthopedic surgery.
Former Korn/Ferry International executive recruiter David Nosal has been found guilty of multiple counts of hacking, stealing trade secrets and conspiracy. Nosal allegedly planned to use information from KFI’s database to launch a rival business.
Parking garage systems manufacturer Park Plus Inc. has sued Rival Boomerang Systems Inc. for defamation. Park Plus alleges that Boomerang has been spreading unfounded claims alleging that Park Plus misappropriated trade secrets and proprietary technology in order to neutralize competition.
Baxter International Inc. was hit with a lawsuit from Millenium Biologix LLC. Millenium has accused the medical device manufacturer of infringing its patents by selling the product Actifuse, a bone graft substitute.
Pfizer Inc. has sued Inventia Healthcare Private Ltd., accusing its competitor of patent infringement regarding a generic bladder-control drug.
VirnetX Holding Corp. has hit Microsoft Corp. with a patent infringement suit, claiming that Skype and Lync violate multiple VirnetX patents pertaining to secure network communications. Three years ago the company won a $106 million verdict against Microsoft for infringing upon some of the same patents.
Clothing designer the Jones Group Inc. has sued rival brand Kenneth Cole Productions Inc. and three former Jones employees, claiming they left Jones for Cole. Jones alleges trade secret misappropriation and seeks compensation from the ex-employees.
Midwestern grocery chain, Schnucks Markets, has fallen victim to a cyber attack. During the breach, which occurred between December 2012 and March 2013, hackers compromised roughly 2.4 million payment cards. Authorities are conducting an on-going investigation.
Intellectual property law firm Gutride Safier LLP filed for an injunction against former partner, Michael R. Reese, claiming he violated their withdrawal agreement by intervening in certain cases.
Former Korn/Ferry International recruiter David Nosal and associate Becky Christian allegedly conspired to hack the company’s database in order to steal trade secrets and use the information to launch a rival business. Nosal and Christian are facing conspiracy, hacking, and trade-secrets charges.
A hacker, or hackers, allegedly part of the Anonymous group, claim to have stolen more than 15,000 passwords belonging to users of North Korean website Uriminzokkiri.com.
A Medical College of Wisconsin researcher has been accused of economic espionage. Hua Jun Zhao may have stolen a patented cancer-research compound to give to Zhejiang University in China.
The makers of Crown Royal whiskey are suing Texas liquid distributor Mexicor Inc. for illegally copying their name (“Crown Club”) and signature velvet bag packing.
Sixing “Steve” Liu, former engineer with a New Jersey-based defense contractor, has received a 5 year sentence after illegally exporting U.S. military technology to China and stealing his former employers’ trade secrets.
AstraZeneca AB has launched a suit in New Jersey federal court accusing drugmaker Actavis Inc. of infringing multiple patents for the drug Nexium. AstraZeneca claims that Activis sought federal approval to product and sell a generic version of Nexium’s active ingredient.
Cybersecurity firm Mandiant has been under attack from unknown sources based in China since it released a report detailing the suspected activities of Chinese military hackers.
The personal information of several celebrities and political officials including Michelle Obama, Hilary Clinton, Joe Biden and Jay-Z have been recently hacked. Officials are investigating the ‘Secret Files’ incident.
The Reserve Bank of Australia has been hacked via an email containing a link to a virus. The attackers were seeking information that included a group of 20 negotiations.
SereniGy Global Inc. filed a $28 million suit against a former marketer. Los Angeles resident Jonathan Mendoza has been accused of divulging trade secrets and attempting to steal clients in violation of his contract.
Evernote has fallen victim to hackers. As a result, it asked its 50 million users to reset their passwords. Hackers accessed e-mail addresses, user names and encrypted passwords.
Microsoft recently fell victim to a cyberattack. A small number of computers, including some in the business unit, were infected by malicious software. It remains undetermined whether or not customer data was affected.
ArrivalStar and Melvino Technologies Ltd. have filed at least 11 suits alleging the infringement of multiple patents involving technology for tracking and monitoring vehicles. The defendants include Hewlett-Packard, Lacoste, New Balance and Nautica.
Ecosphere Technologies Inc. has filed a $300 million arbitration demand against Halliburton Energy Services Inc. Ecosphere alleges violation of a nondisclosure agreement and theft of trade secrets related to a business model.
Express Scripts Inc. has sued accounting firm Ernst & Young LLP and one of its partners, alleging trade secret theft and misappropriation of proprietary data. More than 20,000 pages of confidential information were compromised.
Security firm Bit9 and several of its clients fell victim to hackers. The attack was a direct result of failing to follow their own company policies.
Texas inventor, Alfonso Cioffi, and his daughters, have sued Google Inc., alleging that its search engine, Chrome, infringes upon one or more of their computer security patents.
Canatello LLC has filed lawsuits against Panasonic Corp., Toshiba Corp., Canon Inc. and six other companies, alleging they infringed upon two of its motion detection and security breach notifications patents.
Medical equipment manufacturer Stryker Corp. won a $70 million jury verdict for damages in a patent suit against competing medical device manufacturer Zimmer Inc. The jury found Zimmer guilty of infringing upon three oral irrigation technology patents.
The Department of Energy was attacked by “sophisticated” hackers. The Personally Identifiable Information of several hundred employees was compromised as a result.
Attacks against U.S. multinationals have become more advanced in recent months. U.S. banks and Chevron Corp. have recently been targeted by apparently nation-sponsored attacks.
One day after The New York Times reported that its computers had been repeatedly infiltrated, The Wall Street Journal announced that it too had been attacked by Chinese hackers. The newspaper described the attack as an “ongoing issue.”
The New York Times reported that over the past four months, hackers connected to the Chinese military have repeatedly infiltrated its computers. The attacks were likely in response to NYT’s investigation of Chinese PM Wen Jiabao’s personal wealth.
Neptune Technologies & Bioressources Inc., a company that extracts oils from Antarctic krill used in health products, has launched a complaint accusing multiple competing companies of patent infringement.
Pharmaceutical company Allergan Inc. won a round in a patent battle against two generic drug makers when the U.S. Court of Appeals for the Federal Circuit ruled that a significant portion of the patent for its glaucoma drug, Lumigan, was valid.
Two Chinese citizens pleaded guilty and were sentenced in federal court for attempting to steal intellectual property from insulation producer Pittsburgh Corning Corporation. Ji Li Huang and Xiao Guang conspired to illegally purchase trade secrets for the purpose of opening a competing plant in China.
U.S. packaging machine manufacturer Tipper Tie Inc. has accused Chinese technology company Hunan Kenon of misappropriating trade secrets and using the knowledge to create a competing product.
Halliburton has filed a suit alleging that former employee Hong Wang violated his contract by secretly patenting a drilling process he created while working as an engineer for the company.
Brocade has been awarded permanent injunction in intellectual property theft case against A10 Networks. A San Jose Federal court confirmed a $60 million damages verdict.
Advanced Micro Devices Inc. has accused ex-employees of stealing confidential information in the days before they left the corporation to work for competing company Nvidia Corp. The former employees allegedly transferred more than 100,000 electronic files including sensitive information on licensing agreements and technical information about new products.
New York-based technology company Be In Inc. has launched claims of trade secret theft, copyright infringement and breach of contract against Google Inc. and its YouTube LLC over their Google Plus networking service.
A Chinese citizen pled guilty to operating websites through which he sold more than $100 million worth of pirated computer software to buyers around the world. Xiang Li faces a maximum sentence of 25 years after pleading guilty.
Pinterist Inc. is facing allegations that the idea for the website was stolen from a former Columbia Law School student.
Former VP of Sales at Altegra accused of stealing confidential information, including customer and client lists, methods and procedures for doing business, and pending proposals.
Ex-GM engineer, Shanshan Du, and her husband, Yu Qin, were convicting of stealing proprietary information on car technology in order to give an unfair advantage to a foreign competitor.
An unencryptyed laptop, containing sensitive information for 116,000 individuals was stolen from Alere Home Monitoring. The laptop belonged to an Alere employee and was taken from a locked vehicle. The laptop contained the names, addresses, dates of birth, Social Security numbers, and diagnosis codes.
Cartier International AG won a $30 million judgment against a counterfeit watch seller. The judgement was made after the seller, one of several defendants named in a trademark infringement suit against alleged New York Chinatown counterfeiters, failed to appear in federal court.
Hallmark Cards was awarded $31 million in a trade secrets suit. Hallmark won their case against Monitor Clipper Partners LLC, an investment firm it sued for allegedly using their trade secrets to guide a 2005 purchase of a Hallmark competitor. The jury awarded Hallmark $21.3 million in actual damages and $10 million in punitive damages.
A NASA data breach resulted when a laptop was stolen that included unencrypted personal data on at least 10,000 employees and contractors.
Toyota Motor Credit says an ex-employee stole trade secrets before leaving. A disgruntled former risk analytics manager left with crucial proprietary information about credit scorecards used to evaluate consumers. He downloaded TMCC files onto an external drive prior to leaving.
A judge said that a former AllianceBernstein LP financial adviser accused of stealing trade secrets when he left for Morgan Stanley doesn’t have to turn over his personal iPhone to his old employer’s attorneys because it could contain confidential information.
The trial began in U.S. District Court for a former General Motors engineer and her husband who are charged with conspiring to steal trade secrets. Shanshan Du, 53, the former GM employee, and her husband, Yu Qin, 51, were charged in 2010 in a seven-count indictment with trying to steal GM trade secrets related to hybrid vehicles to pass on to China’s Chery Automobile Co.
IP theft is often an inside job. Many companies do not realize that external threats against their assets are not nearly as serious as those that are coming from employees, former employees and contractors. Statistics cited by the authors of the referenced article indicate that more than 3 out of 4 cases of IP theft are perpetrated by insiders or contractors. http://bit.ly/XkCLRn
South Carolina revealed a massive data breach of Social Security numbers (3.6 million) and credit cards (387,000). They were exposed after a server at the state’s Department of Revenue was breached by an international hacker.
Barnes & Noble stores experienced a credit card data breach when hackers broke into the keypads in front of registers where customers swipe their credit cards and enter their personal identification numbers, or PINs.
Zynga Inc., the San Francisco-based games company, sued its former studio general manager for trade-secret misappropriation and breach of contract. Alan Patmore took with him more than 700 files containing confidential Zynga information when he left the company in August to join competitor Kixeye, according to the complaint filed Oct. 12 in court.
An ex-Bridgestone scientist was cleared of trade secret theft charges. When he was fired, Wang downloaded over 400 documents, many containing trade secrets. A U.S. District Judge ruled there wasn’t enough evidence that Wang was going to economically benefit from taking the documents or that he knew it would hurt the company.
U.S. prosecutors charged 11 people with illegally exporting advanced microelectronics that can be used for military purposes. They were allegedly destined for sale to Russian military and intelligence agencies. http://nyti.ms/RxHB7s
Reuters article highlights that trade secret thefts, often obtained by sophisticated cyber-attacks, are becoming a more serious problem for China-U.S. business. http://reut.rs/OEI5LG
The White House acknowledged an attempt to infiltrate its computer system but says it thwarted the effort.
A Chinese national, a former engineer at the Space and Navigation Division of L-3 Communications, was convicted of illegally exporting U.S. military technology to China and stealing trade secrets. The stolen electronic files detailed the performance and design of guidance systems for missiles, rockets, target locators and unmanned aerial vehicles.
Telvent Canada, a supplier of remote administration and monitoring tools to the energy sector, was a victim of a sophisticated cyber attack that breached their internal firewall and security systems.
A former CME programmer plead guilty to trade secret theft after he and two business partners downloaded more than 10,000 files of CME’s computer source code. Chunlai Yang, a Chinese national, had plans to form a business in China.
Two Chinese nationals were charged with attempting to pay $100,000 for stolen trade secrets from Pittsburgh Corning, in order to open a competing plant in China.
Toyota filed suit against an ex-contractor for sabotaging the company’s supplier network and stealing proprietary trade secrets and information including pricing information, quality testing data, and parts testing data.
A former Intel employee was sentenced to 3 years for stealing valuable computer chip manufacturing and design documents. Biswamohan Pani, stole the documents in 2008 after accepting a job at one of Intel’s competitors.
LG Display announced that 11 people, including six employees, have been charged with stealing advanced OLED TV display technology from Samsung between 2010 and 2011.
A British company suffered lost revenues of €1.0 billion ($1.25 billion) from a state-sponsored cyber attack against its computer systems that resulted in intellectual-property loss.
A scientist accused of stealing secret formulas from a Utah chemistry company has pleaded guilty to a federal computer charge.
A former Silicon Valley engineer convicted of stealing trade secrets by copying them from Marvell Semiconductor Inc.’s secure database.
Former research chemist at a global pharmaceutical company is sentenced to 18 months in prison for theft of trade secrets.
Former Intel employee pleaded guilty to stealing computer chip manufacturing and design documents worth millions.
It’s easier than you think for your sensitive data – such as intellectual assets, trade secrets, protected health information, or customer data – to fall into the hands of a competitor, hacker, disgruntled employee, or foreign government.
Let us introduce you to some of our team members who will be helping you secure your enterprise.
Len joined TSC in 2013. He offers more than 20 years of experience in the military, consulting, and high-tech industries, developing system and enterprise architectures to solve complex business problems with technology. His resume includes ManTech International, where he focused on collaborative technologies and agile development, and the consulting firms Booz Allen Hamilton and BearingPoint, where he led several enterprise architecture projects for large U.S. Government organizations. Len also has experience with large-scale integrators including positions at Raytheon and Boeing, as well as 10 years in the United States Air Force as a navigator. Len earned a Bachelor’s degree in Computer Science from Syracuse University, a Masters of Science in Computer Information Systems from St. Mary’s University, and a Doctor of Computer Science from Colorado Technical University.
Allen joined the company in 2011. With more than 20 years of experience in the commercial and government sectors, Allen has worked at a variety of organizations including several Fortune 500 corporations. During his commercial tenure, Allen managed numerous programs within the telecommunications and information security industries, including several large multi-million dollar projects related to cellular/satellite network implementation. Allen’s background also includes defense policy analysis and national security policy, as well as military experience in the US Navy as a Russian Linguist and Soviet Naval analyst. Allen possesses a PMP and CISSP certification and holds a Masters degree in International Affairs from Columbia University.
Armond joined TSC in 2011 and has 10 years of international security and consulting experience. He has managed complex global projects as well as led specialized training and awareness programs focusing on threat remediation and intellectual asset protection for both the private and public sector. He holds a Masters degree in International Affairs with an emphasis on International Business from Tufts University’s Fletcher School.
Natalie has been with the company since 2007. With more than 15 years of experience as an intelligence professional, Natalie’s expertise spans both the government and commercial sectors. Natalie’s work for the U.S. Government includes extensive experience in the identification, acquisition, and development of critical information, supporting high value national security interests. In the commercial arena, Natalie led the development of innovative methods to acquire and analyze critical information to protect specific interests and high-value intellectual assets. Natalie holds a Masters degree in International Relations from Yale University.
Interested in proactively defending your enterprise? Curious about possible employment opportunities?