Corporate espionage and other threats to companies

SANS has determined that B2B corporate espionage is the next big worry for companies according to their latest research: http://www.infoworld.com/article/08/01/15/Cyber-espionage-moves-into-B2B_1.html. With that in mind, I see further need for proper protection of information in organizations, and most organizations will have to scramble to meet these new challenges. I believe that with a combination of DLP, Classification, Protection, and Audit, will be further needed in organizations. The game has moved from being regulatory compliant, to be able to protect your valuables. The last thing you want is to be notified by the federal government that your information may have been compromised. It is time to start thinking about how to safeguard your information. It is also interesting to see that SANS have identified the insider threat as growing: http://www.sans.org/2008menaces/?utm_source=web-sans&utm_medium=text-ad&utm_content=text-link_2008menaces_homepage&utm_campaign=Top_10__Cyber_Security_Menaces_-_2008&ref=22218. Ensuring that insiders do not have access to more information than they need is paramount. If you combine this threat with new search technologies such as Google for enterprise, Fast, Microsoft Search Server and other technologies enabling the malicious insider an easy way to steal sensitive information.

The three tenants of safeguarding information are:
Identify:
Where it is, What it is, Who has access, if the information is still needed, and to determine if is it protected
Protect: Ensure proper classification, proper access rights, and encrypt sensitive information
If information is found that is properly protected:
Remediate:
Classify information appropriately according to policy and or regulatory requirements
Remove excess access rights and force periodic re-validation of access rights
Apply encryption on sensitive information if found un-encrypted.
Remove unneeded information
Audit:
Prove that the information is in its appropriate location
Prove that only required personnel has access
Prove that information is properly classified
Prove that sensitive information is encrypted
Prove that retention policies are adhered to

What does this mean for the different verticals?

Financial sector
Insurance
Health Care
Pharmaceuticals
Manufacturing
Technology

For the financial sector, the most important aspect will still be regulatory compliance, but being able to protect business secrets will become more important. Example from Wall Street is the use of DRM to protect information to be forwarded when financial gains opportunities are sent out to prospective investors. Of course irate customers who have lost monies, or have been inconvenienced will also be a driving factor

For the insurance industry, I believe the most important aspect will still be the public's perception of how well their information is protected, as well as regulatory compliance. However, the loss of business data such as marketing plans, and customer databases to competitors should also rank high

For health care, I believe the most important task is to protect patients health information. See previous entry in blog on California's new law. HIPAA has been around for a while, but with this new law, regulatory compliance becomes even more important
For pharmaceutical companies, I believe B2B espionage will become an even more troublesome area for them to address. Especially considering the heightened competition from smaller companies abroad.

For manufacturing, manufacturing processes and blueprints are the crown jewels that needs protection. Contract negotiations are also an area of concern for manufacturing. If information is lost that can better the position for the other party, profit loss and lost competitive edge ensues.
For technology companies, customer information, regulatory requirements, Intellectual Property protection and business intelligence are areas of concern along with contract negotiations