Wednesday, March 24, 2010

Story of a failed data heist



Data is the new-age asset and is at risk from insiders and outsiders who may try every ruse in the book to steal. Personal data, ideas, plans, designs, patents, formulae financial information and such data have ready takers among your competition or in the underground market. Or worse, your data may be used to start up a new competitor! No wonder, information security grows increasingly important and just like one has uniformed guards on the physical perimeter; technology has to be leveraged to make sure that data assets are not pilfered.
High Flying Company Inc, (HFC) very nearly became a victim of a data heist when their Head of Delivery, John Turnbull, walked out to start his own venture ‘Fly Higher Corporation Inc. (FHC). What saved them was the foresight to invest in technology that helped safeguard data assets in a user friendly manner.
HFC has been in the business for more than a decade and John worked his way up the corporate ladder to a position of eminence as Head of Delivery. His responsibilities include interaction with internal teams, vendors and clients and over time he had built up a good reputation. Having helped the growth of HFC into a mature vendor, he was looking forward to being promoted as COO which did not happen, since the management hired Paul in this role.
Now John was hassled and unknown to all his friends and managers he starts working on a hidden agenda - go independent! Start up his own firm, hiring people on contract, using the ideas and designs he has worked on and getting a head start over many players in the market. In stealth mode, John adds to his collection of designs and corporate collateral he will carry along with him the day he leaves his job. Since he has access to sensitive / important data this is easy for him and he uses pen-drives and DVDs to copy all that he can use in his new venture.
Once this mission was fulfilled, and he had copied all the data, he put in his papers.
The management does not know John has stolen company assets and has planned to compete against them in the same markets, using their designs and data. His settlement done, John gets into action mode, incorporates his new firm Fly Higher Corporation Inc and starts wooing the same clientele and vendors.
John gets a team together and they start work of cloning the proprietary designs and plans of HFC to FHC in order to make their first bids. Work progresses well at the low level design phase and hits a roadblock when they try to access one of the critical design files. It just does not open and keeps asking for authorization. John team sweats as the team tries to open other files – low level and unnecessary files can be accessed easily but the important ones just do not respond.
Now FHC hires an unethical hacker to brute force the files but, unfortunately, this does not work since the encryption algorithms are on the FileSecure server at HFC (John’s ex company). And John realizes that his heist has failed, because the Information Security office at HFC had implemented Information Rights Management and all sensitive / critical / important data was secured using this technology.
Of course, John couldn’t go complain to the HFC management about this failed theft and now he is working hard to build original designs for presenting to potential clients. It is hard work and maybe will take FHC a decade or more to reach the position of eminence of HFC !
While it is true that crime never pays but in the technology age it is important to ensure technology controls are in place to secure one’s assets, rather than wait for a breach or an incident.
Data assets are the crown jewels for any organization, whether public or private, and for individuals and need to be protected in such a manner that they are available only to authorized persons. New age technologies like Information Rights Management go the extra mile to bring access and asset management together providing a highly secure system that is robust, works unobtrusively, enables regulatory compliance and is user friendly.

0 comments:

È