The Counterintelligence Mind-Set

As hacking has grown more purposeful, the traditional IT security mind-set has failed to keep up. "There's virtually unlimited information to protect and unlimited supply of threat and vulnerability," says Motorola's Boni. And there are no easy solutions. "Risk management oversight over distant suppliers is an emerging art," Boni says.

The vast majority of IP loss incidents are simple errors: posting information to externally facing Web sites wrongly assumed to be protected or including confidential information in a reply to an e-mail that includes external recipients, says Boni. The most successful hacks, says Bumgarner, occur because attackers get lucky, stumbling across a vulnerability while scanning thousands of IP addresses. But the most dangerous attacks are deliberate.

To defend against targeted attacks, Motorola uses traditional controls such as firewalls, intrusion detection tools, antivirus software and digital forensics — but with a difference. "We're operating our information security toolkit with a counterintelligence mind-set," says Boni. Like the military, Boni assumes there's an enemy looking for an advantage and it's his job to outwit him. "Putting those tools together with an understanding of what is or could be of greatest interest to competitors allows a more granular focus on the data," says Boni, "not just on the network."

Boni partners closely with business units to attempt to forecast the risk to particular IP-related information. "Every product or service has market share and projected financials. We try to understand what pieces of information are the key contributors to that product or service and whether they are at risk to targeted attacks."

More companies need to adopt this more nuanced approach, agrees O Sami Saydjari, president of Cyber Defence Agency, a security consultancy. "They'll hire white-hat hackers — doorknob turners who shake all your doors and tell you where they got in," Saydjari says. "And the company will try to figure out where to close those vulnerabilities. That's primitive analysis." When Bailey, the government contractor, conducted penetration testing of his internal systems, the white hats delivered a five-inch-thick report of vulnerabilities. Bailey says he closed every hole, but he ignored the extranet. Nor did he have a comprehensive program for updating systems and installing patches. "The lessons learned from the exploit were not uniformly applied across the business," says Bailey. "That was my mistake."

While monitoring and patching of systems is essential to any security strategy, many CIOs and IT security professionals approach the task backward, says Schmidt. "The discussion always seems to be: Tell me where the threat is and I'll secure that system," Schmidt says. "You need to test systems for vulnerabilities before deploying, have a plan in place to patch them, and audit to see who's doing what and where data is."

Turning the traditional approach to security on its head can help IT organizations prioritize spending to protect critical IP. "You need to look at the mission of the organization from the top down as opposed to the bottom up," Saydjari explains.