Many organizations rely on unique and valuable ideas, innovation, and knowledge to gain a competitive edge in the market. This is commonly referred to as Intellectual Property (IP) which consists of trade secrets, trademarks, patents, copyrights, drawings, and sensitive business information. For example, for a pharmaceutical manufacturing organization, the formula for a groundbreaking medication is considered IP or for a gaming software organization, the upcoming copy of a game pre-release is considered IP.
By Kartik Shahani, Country Manager, Tenable India
IP is one of the most valuable assets of an organization as it is how an organization differentiates itself from its competition. Cybercriminals understand the value of IP and are therefore constantly looking for ways to steal and monetize it. According to i-Sight, the estimated global value of counterfeit and pirated products is $500 billion higher today than it was in 2015 (1.7 trillion). IP theft is more common than you might think. Attacks using IP theft have also begun to manifest themselves in the form of theft/ransom schemes, where the attacker will steal valuable IP, then threaten to release this IP unless a ransom is paid. Within India, during 2020 one in four Indian organizations suffered business-impacting cyberattacks resulting in the theft of IP, a Forrester study commissioned by Tenable revealed.
Having an organization’s IP stolen has far-reaching negative consequences in the form of damage to competitive position, lost revenue, legal fees, and damage to brand reputation. Losing IP could mean forfeiting the first-to-market advantage, or in the worst case — losing entire lines of business to competitors.
Protect the crown jewels of an organization
CISOs should work in tandem with business leaders to determine the organization’s crown jewels and prioritize cybersecurity efforts accordingly. Understanding which threats pose the greatest business risk and aligning cybersecurity strategies with business objectives is crucial to protecting IP.
Embrace foundational cyber hygiene
All organizations must implement foundational cyber hygiene practices such as asset inventory, vulnerability scanning, patch application, antivirus and anti-malware tools, firewalls, and company-wide security policies – as a first step.
In looking at the top 10 routinely exploited vulnerabilities, publicly known but unpatched flaws provide cybercriminals with a window of opportunity to gain a foothold into the organization’s network. This is because many organizations struggle to keep pace with the sheer volume of newly discovered vulnerabilities.
A risk-based approach to vulnerability management is key in helping organizations prioritize risks based on threat context and the potential impact on businesses. A risk-based approach takes the position that vulnerabilities that expose the organization to the greatest risk should be mitigated first. Understanding the actual and not theoretical impact of vulnerabilities and focusing remediation efforts based on business risk is a more effective way to protect IP.
Understand your network and the expanded attack surface
With remote work being the new normal, keep an inventory of all the hosts and devices connected to the network. Pay special attention to personal devices as these may not include the same protections as company-issued ones. Also, be mindful of applications running on a network. Unauthorized, unknown, or dormant apps are red flags.
Not all IP theft comes from external sources. Theft can be perpetrated by insiders with legitimate access to the network. It is therefore critical to identify internal systems and users that have access to the IP. Access and permissions given to employees, service contractors, temporary workers and systems accounts must be monitored. By empowering organizations to prioritize their vulnerability management results based on the privileges afforded to each end-user in the system, security teams can effectively disrupt the attack paths cybercriminals use to install malware, move laterally and exfiltrate data.
In a highly digitized environment, IP is highly lucrative. Organizations must therefore endeavor to identify and patch known vulnerabilities, constantly monitor their network, and have visibility over who has access to systems and resources at all times.
About the Author
Kartik Shahani is the Country Manager for Tenable India. He is responsible for spearheading strategic initiatives in the enterprise security market, managing operations, and channel activities in the region. With over 30 years of experience, Kartik has extensive knowledge in sectors such as telecommunications, finance, and government. Shahani joined Tenable from RSA Security, a division of Dell EMC, where he was Director for Channel in the Asia Pacific and Japan.
Disclaimer
Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.
