Chapter 7: Industrial Espionage in Cyberspace

Computer Security Fundamentals - Chapter 7: Industrial Espionage in Cyberspace

Chapter Objectives

  • Understand what is meant by industrial espionage.

  • Explain the dangers of industrial espionage.

  • Understand the low-technology methods used to attempt industrial espionage.

  • Understand how spyware is used in espionage.

  • Know how to protect a system from espionage.

Introduction to Espionage

  • Espionage:

    • Not characterized by…

    • Sophisticated glamour.

    • Exciting adventure.

    • Ultimate goal:

    • Collecting information.

    • Conducting operations without fanfare, unwanted attention, or detection by the targeted organization.

  • Agents of Espionage:

    • Not only conducted by governments, intelligence agencies, or terrorists engaged in political and military espionage.

    • Also performed by private companies to gain advantages in business context.

    • Industrial Espionage:

    • Involves billions of dollars at stake, leading to companies hiding their role as perpetrators or targets.

What Is Industrial Espionage?

  • Definition:

    • Industrial espionage involves spying to discover valuable information such as:

    • Competitor's projects.

    • Client lists.

    • Research data.

    • Though goals differ from military espionage, methods like electronic monitoring and document photocopying are similar.

Information as an Asset

  • Value of Information:

    • Information is a crucial asset for companies, significantly impacting their operations.

    • Expenditure on research and development is in the billions annually.

    • How to assess the value of information:

    • VI=C+VGVI = C + VG

      • where:

      • VIVI = Value of Information

      • CC = Cost to Produce

      • VGVG = Value Gained.

    • Importance of data:

    • Often, information is worth more than the hardware/software housing it.

  • Reasons for Data Value:

    • Time and effort spent creating and analyzing the data.

    • Intrinsic value due to:

    • Proprietary processes, inventions, or algorithms.

    • Competitive advantages.

  • Asset Identification:

    • Listing the organization’s assets includes:

    • Items impacting daily operations.

    • Items tied to the organization's products or services.

Real-World Examples of Industrial Espionage

  • Various notable instances include:

    • Hacker Group incidents.

    • Legal disputes, such as that between Fiat and General Motors.

    • Cases involving nuclear secrets.

    • Incidents involving Uber.

    • Economic espionage conducted by foreign governments.

  • Corporate Denials:

    • Most companies refuse to admit involvement in espionage or discuss it publicly.

    • Example: Larry Ellison, CEO of Oracle Corporation, defended his hiring of a private investigator to engage in dubious data collection methods against Microsoft.

Methods of Espionage

  • Espionage can occur via:

    • Low-Tech Methods:

    • Employees physically taking data or divulging sensitive information.

    • Techniques such as social engineering.

    • Technology-Oriented Methods:

    • Utilization of spyware, cookies, and key loggers for data interception.

  • Low-Tech Industrial Espionage Mechanisms:

    • Employees may disclose sensitive data, with information being easily portable via:

    • CDs, flash drives.

    • Use of social engineering tactics through email.

    • Disgruntled employees often pose a risk, with various motives for data mishandling.

  • Spyware Usage:

    • Any form of monitoring software, such as spyware, key loggers, and screen capture tools, can facilitate industrial espionage.

  • Steganography:

    • Method of maintaining secrecy of messages, obscuring the content to protect communications.

  • Phone Taps and Bugs:

    • Involves leveraging utilities to intercept calls through physical line tapping.

  • Hireable Spies:

    • Experienced investigators and former intelligence operatives can be employed in espionage actions.

Protecting Against Industrial Espionage

  • Complete security against espionage is unattainable; however, mitigation strategies include:

    • Employing antispyware software.

    • Utilizing firewalls and intrusion detection systems.

    • Implementing robust organizational security policies.

    • Encrypting all data transmissions.

  • Mitigating Internal Espionage Risks:

    • Access to sensitive data should be on a “need-to-know” basis only.

    • Separation of duties for critical data management.

    • Limit the use of portable storage media and personal mobile devices.

    • Strict policies to prevent any media/documents from leaving the premises.

    • Conducting thorough background checks on employees.

    • Scanning PCs of departing employees for sensitive information.

    • Secure storage of tape backups, physical documents, and other media.

    • Ensuring hard drives of portable computers are encrypted.

Spear Phishing

  • Definition and Mechanism:

    • Utilizes phishing technology but targets specific individuals or groups.

    • Involves sending tailored emails aimed at acquiring personal information to compromise identities or systems.

    • Whaling: a specific instance of spear phishing targeting high-profile employees for critical information.

Summary

  • Industrial espionage exists as a growing threat with various methods of execution.

  • Employee disclosures remain the most common methodology for information theft.

  • Compromising information systems is an increasingly adopted strategy for espionage.