Auditing Protection of Intellectual Property
David Cronkright
Chuck Dudinetz
Paul Jones
Corporate Auditing
The Dow Chemical Company
February 16, 2012
Agenda
• About Dow
• What is IP and why do we care?
• What’s the risk?
• What are the key controls?
• How do we audit information protection controls?
• Questions & Answers
Agenda
• About Dow
• What is IP and why do we care?
• What’s the risk?
• What are the key controls?
• How do we audit information protection controls?
• Questions & Answers
What is IP and why do we care?
IP is an asset to be protected…
 Technology
 Business intelligence
 Personal Data
What is IP and why do we care?
IP can take a number of forms…
Explicit
– Electronically stored
– Hardcopy
– The “object” itself
Tacit
– Conversations
– Presentations
What is IP and why do we care?
Loss of IP can have significant consequences…
– Loss of competitive advantage  loss of business
– Loss of licensing revenue
– Loss of prospective M&A partner
– Non-compliance with legal/regulatory requirements
– Damage to reputation
– Sabotage
Agenda
• About Dow
• What is IP and why do we care?
• What’s the risk?
• What are the key controls?
• How do we audit information protection controls?
• Questions & Answers
What’s the risk ?
• Risk = Threat x Vulnerability x Consequence
What’s the risk ?
9
What’s the risk ?
Threats…
Industrial Espionage
•
•
•
•
Targeting & recruitment of insiders
Cyber intrusions
Dumpster diving
Establishment of business relationships
… Increasingly highly organized, funded, and resourced
Hacktivism
• Politically or socially motivated
• Cause reputation damage
Cyber Crime
• Profit motive
What’s the risk ?
Potential Vulnerabilities…
Inherent vulnerabilities
• Targeted industry ?
• Geographic presence
Company culture
• Culture of trust ?
• Collaborative culture ?
• Education & awareness
• Weak policies & procedures
… translate to behaviors
What’s the risk ?
Potential Vulnerabilities (Cont’d)…
Workforce dynamics
•
•
•
•
Outsourcing
Turnover
Hiring practices
Employee morale
Facility
•
•
•
•
•
•
Weak physical security
Multi-tenancy
3rd Party service providers
Open work space
Waste segregation and disposal
Poor handling of printed documents, portable media
What’s the risk ?
Potential Vulnerabilities (Cont’d)…
I/T
•
•
•
•
•
•
Weak computer room security
Broadly accessible network ports
Unsecure data transfer
Inappropriate access to electronic repositories
Network perimeter
Susceptibility to malware
Agenda
• About Dow
• What is IP and why do we care?
• What’s the risk?
• What are the key controls?
• How do we audit information protection controls?
• Questions & Answers
What are the Controls ?
Controls :
Mitigate the likelihood and/or impact of the threat
exploiting a vulnerability
What are the Controls ?
Governance
•
•
•
•
Assessing Risk
Organization design/steering
Communication
Monitoring
Preventive
•
•
•
•
•
•
•
Secure the network perimeter (Firewalls, IPS)
Secure the data (repository-level access control, DRM, DLP)
Physical security (badge access)
Confidentiality agreements
Workforce education (culture, behaviors)
Secure disposal of media (including hardcopy)
Contractual verbiage/third party assurance (for outsourced data)
What are the Controls ?
Detective
–
–
–
–
Intrusion detection (NIDS, HIDS)
Critical log review
Workforce monitoring (behavior changes, hoarding data)
Monitoring of information extraction/downloading
What are the Controls ?
• Information handling policies
Preventive
Non-I/T
• Badge access
• Work area
• Background
• Employee education
segregation
checks
• Workforce
• Locked cabinets
• Confidentiality
behavior
agreements
• Information
monitoring
classification
• Clean desk policy
• Workforce
• Investigative
onboarding &
• Document & media disposal
processes
offboarding
• Secured network ports
• Strong passwords
• Elevated access
• Computer room security
• Firewalls
• Encrypted data transfer
• Data Loss
• Intrusion Prevention
Prevention
(DLP)
• Egress traffic • Network segmentation
• Antivirus
• Application
• I/T access control
whitelisting
• Patching
- Repository level
I/T
- Data level (DRM)
• Information
access
monitoring
• Physical
security
surveillance
• Vehicle
inspections
• Workforce
offboarding
Detective
• Security incident
response
• Intrusion Detection
• Vulnerability scanning
• Logging
- Capture
- Retention
- Analysis
• Asset identification &
inventory
How do we audit information protection controls ?
– “Network Perimeter” audits
• Common Network access points
• VPN/RAS, Firewalls/Proxy Servers, Circuits, Modems, Physical
Controls
– “Intellectual Property” specific audits
• Where the data lives (ex: Crown Jewels)
• Site, Application, Project specific or Hybrid
– “Cyber Security” audits
• Organization’s ability to “sense and respond” to changing threat
landscape
• Governance and Control assessments
– “Integrated” audits (strategy going forward)
“Network Perimeter” Audit
• Information handling policies
Preventive
Non-I/T
• Badge access
• Work area
• Background
• Employee education
segregation
checks
• Workforce
• Locked cabinets
• Confidentiality
behavior
agreements
• Information
monitoring
classification
• Clean desk policy
• Workforce
• Investigative
onboarding &
• Document & media disposal
processes
offboarding
• Secured network ports
• Strong passwords
• Elevated access
• Computer room security
• Firewalls
• Encrypted data transfer
• Data Loss
• Intrusion Prevention
Prevention
(DLP)
• Egress traffic • Network segmentation
• Antivirus
• Application
• I/T access control
whitelisting
• Patching
- Repository level
I/T
- Data level (DRM)
• Information
access
monitoring
• Physical
security
surveillance
• Vehicle
inspections
• Workforce
offboarding
Detective
• Security incident
response
• Intrusion Detection
• Vulnerability scanning
• Logging
- Capture
- Retention
- Analysis
• Asset identification &
inventory
“Intellectual Property” Audit
• Information handling policies
Preventive
Non-I/T
• Badge access
• Work area
• Background
• Employee education
segregation
checks
• Workforce
• Locked cabinets
• Confidentiality
behavior
agreements
• Information
monitoring
classification
• Clean desk policy
• Workforce
• Investigative
onboarding &
• Document & media disposal
processes
offboarding
• Secured network ports
• Strong passwords
• Elevated access
• Computer room security
• Firewalls
• Encrypted data transfer
• Data Loss
• Intrusion Prevention
Prevention
(DLP)
• Egress traffic • Network segmentation
• Antivirus
• Application
• I/T access control
whitelisting
• Patching
- Repository level
I/T
- Data level (DRM)
• Information
access
monitoring
• Physical
security
surveillance
• Vehicle
inspections
• Workforce
offboarding
Detective
• Security incident
response
• Intrusion Detection
• Vulnerability scanning
• Logging
- Capture
- Retention
- Analysis
• Asset identification &
inventory
“Intellectual Property” Audit - Learnings
• Much more than “just” I/T controls
• “Sense and respond” approach (peripheral vision)
• Consider effectiveness of controls as a whole
– Layering of controls
– Audit judgment required
• Position to avoid pre-audit window dressing
• Finding broader issues
“Cyber Security” Audit
• Information handling policies
Preventive
Non-I/T
• Badge access
• Work area
• Background
• Employee education
segregation
checks
• Workforce
• Locked cabinets
• Confidentiality
behavior
agreements
• Information
monitoring
classification
• Clean desk policy
• Workforce
• Investigative
onboarding &
• Document & media disposal
processes
offboarding
• Secured network ports
• Strong passwords
• Elevated access
• Computer room security
• Firewalls
• Encrypted data transfer
• Data Loss
• Intrusion Prevention
Prevention
(DLP)
• Egress traffic • Network segmentation
• Antivirus
• Application
• I/T access control
whitelisting
• Patching
- Repository level
I/T
- Data level (DRM)
• Information
access
monitoring
• Physical
security
surveillance
• Vehicle
inspections
• Workforce
offboarding
Detective
• Security incident
response
• Intrusion Detection
• Vulnerability scanning
• Logging
- Capture
- Retention
- Analysis
• Asset identification &
inventory
External Threat – Cyber Security
• It use to be that each company was it’s own little cyber
kingdom and physical access was the king of control for
external threats
• Thanks to the internet - everything touches everything so
vulnerabilities have increased
• The number, ability and motives of external threats are
also increasing
• Updated External Threat audit programs two years ago
External Threat – Cyber Security
• While press releases of APT compromises were out there
little else was available on “APT what and how”
• Lacked expertise / experience to understand threat termed
APT (Advanced Persistent Threat)
• Researched several firms specializing in APT
• The project looked at the threat, it’s motives, processes
used to compromise a target and the controls required to
slow down, detect and eradicate it.
External Threat – Cyber Security
• The APT is real and has more time and money to get at
your IP than you have time and money to secure it.
• It is a paradigm shift from a controls perspective. The logic
is “They will get to your data”….
• Preventive controls are there to slow them down so
detective controls have time to identify the breach.
• Proper response is required to assure you get all of the
comprise before they know you’re on to them.
• To date espionage has been the primary objective
External Threat – Cyber Security
Results - Two high level audit programs and insight into the
new breed of Cyber Threat
Governance
•
•
•
•
Organization & strategy
Key Relationships
Training and Awareness
Establishing the bar; COSO observations
Control Assessment
•
•
•
Preventive
Detective
Response
Agenda
• About Dow
• What is IP and why do we care?
• What’s the risk?
• What are the key controls?
• How do we audit information protection controls?
• Questions & Answers