Chapter 7 Industrial Espionage in Cyberspace

Posted on by

Dr. Chuck Easttom, Computer Security Fundamentals, Fourth Edition. Pearson Education, Inc, 2020 pp 182-199

Chapter Objectives

  • Understand the term “industrial espionage”
  • Understand how low-technology methods are used
  • Learn about spyware
  • Know how to protect a system

Introduction

Espionage is more than James Bond, Austin Powers, Johnny English and Archer. It is not as glamorous or exciting either.

The simple goal of espionage is to obtain secret information, preferably without the owners of that information knowing.

Espionage is not only used by government and federal agencies, such as the CIA or MI6, but by corporate organisations that wish to obtain information about rivals. Governments utilise espionage for political or military reasons – companies use it to make money.

It is difficult to assess how espionage affects companies as neither spy or victim wish to reveal their activities: the spy does not want people to know they have been spying, and the victim does not want people to know they have been spied on.

As a security professional, you will want to protect yourself against espionage and know how it happens and what tools can be used, such as keyloggers, spyware, and screen-capture software.

Two famous cases of espionage mentioned in the book are detailed below:

Industrial espionage, which can be categorised as:

  • Trespassing onto a competitor’s property or accessing their files without permission
  • Posing as a competitor’s employee in order to learn company trade secrets or other confidential information
  • Wiretapping a competitor
  • Hacking into a competitor’s computers
  • Attacking a competitor’s website with malware

More info here: https://www.csoonline.com/article/565748/what-is-corporate-espionage-inside-the-murky-world-of-private-spying.html

Corporate espionage and state sponsored-spying: https://www.forbes.com/sites/betsyatkins/2019/02/12/learning-from-apples-spying-incidents-how-to-protect-your-company-from-corporate-espionage/#54d18f7d6fb4

What Is Industrial Espionage?

A quick and simple video explains: https://www.dw.com/en/what-is-industrial-espionage/video-69457507

Industrial espionage is finding out valuable information that is not publicly available using spying tools and techniques. This valuable information when obtained gives the spier an economic advantage.

Corporate espionage includes monitoring, photocopying files, or using social engineering to poach employees or manipulate company secrets from them.

Economic espionage uses the same techniques and often the same people: people who have previously worked for intelligence agencies become expert corporate spies, making it difficult for them to be traced.

Anecdotal evidence would suggest that the most common form of espionage is simply an employee quitting, taking a job with another firm, and leaving the first firm with sensitive data. p 184

When an employee leaves your company, there are various ways you can protect your company from potential corporate espionage:

  • implement nondisclosure and noncompete agreements
  • limit an employee’s access to company data while they work their notice/before they are fired eg garden leave
  • conduct exit interviews to make clear your own stance and find out how the employee is feeling
  • confiscate physical objects that could contain sensitive data such as handbooks, manuals, phonebooks, and hardware

Information as an Asset

Data is extremely valuable, and companies spend a lot of money on research. Espionage can result in all that information going to another company who can then reap the rewards.

An equation to use when considering how much your data is worth is:

resources used to gain information + economic gain as a result of this information = value, or:

VI (Value of Information) = C (Cost to Produce) + VG (Value Gained)

We are living in the “information age” which is where data can be bought and sold at high prices.

A good analogy for how valuable information is a university degree. You pay a lot of money to attend lectures and read recommended books, are tested on this information, and over the course of years are rewarded with a certificate. That certificate in itself is not worth much; but the value it represents is thousands of pounds worth of knowledge. Often, the data stored on a device is worth more than the device itself.

Data is considered a valuable commodity due to two reasons:

  • time spent and effort expended (staff salaries)
  • intrinsic value, i.e., data about a new invention or process

Asset identification

Any company can be a target for corporate espionage. Data you have about your customers, email addresses, phone numbers, payment details, clients, employees – all of this is valuable to someone.

One thing you can do to protect your company is asset identification. This entails making a list of all assets you have that your company uses. These could be:

  • information assets (information employees use daily – product designs, software programs, system designs, documentation, customer orders, personnel data)
  • information systems (where the assets are stored)
  • applications and services
  • other assets (databases holding customer data, word processors like Microsoft Office, IDEs, compilers, HR systems, CRMs etc.)

A worksheet is provided by CERT that can help you document your assets: https://www.cisa.gov/sites/default/files/c3vp/crr_resources_guides/CRR_Resource_Guide-AM.pdf

Real-World Examples of Industrial Espionage

According to a CNN Report, 2015 saw a 53% increase in cases of industrial espionage, with a significant number of industrial espionage cases involving insider threats. p189

In 2016, the Harvard Business Review released an article stating that “Industrial Espionage Is More Effective Than R&D“.

Although earlier in the chapter Easttom states that companies will not openly admit they spy on competitors, the exception is Larry Ellison of Oracle who hired an intelligence organisation to garner Microsoft’s secrets:

“We weren’t spying. We were trying to expose what Microsoft was doing,” said a fiery Ellison when reporters asked repeatedly about the detective agency’s attempts at buying garbage. “Maybe our investigation organization may have done things unsavory, but it’s not illegal. We got the truth out.”

https://www.cnet.com/tech/tech-industry/oracle-chief-defends-microsoft-snooping

An expert security professional will ensure the integrity of their data and do their best to stay aware of and prevent any espionage attempts.

How Does Espionage Occur?

  • extract data from company employees via conversation (social engineering)
  • smuggle data out of the system using physical devices such as USB drives, CDs, photographs, or even paper
  • install spyware onto target computer systems that can log keys or take screenshots
  • tapping phones

Steganography

Steganography is hiding messages within other messages. This could be a message written on a letter in invisible ink, or an image hidden within a photograph. Data can be hidden in any computer file.

The most common method used is using the LSB (Least Significant Bit) where that bit is changed just enough to keep the original image intact, but introduce the secret message. The video below explains this:

There is software available that can create stenographic files:

  • QuickStego
  • Invisible Secrets
  • MP3Stego
  • JSteg

Steganography has been around for centuries, and the history is very interesting; you can read more about it on Wikipedia: https://en.wikipedia.org/wiki/Steganography

Protecting Against Industrial Espionage

There is no way to make your defences against spying tactics completely watertight: the best way is to alleviate the danger and make it as difficult as possible for spies to extract information from your systems and employees:

  • install antispyware software
  • use firewalls and IDS/IPS (intrusion detection/protection software)
  • keep software up to date
  • educate staff on best practices to keep themselves and the system safe
  • encrypt data transmissions

However, if you do have insider threats such as a naïve, unhappy, or just plain desperate employee, there are additional measures that need to be taken:

  • least privileges principle: limit user access to data
  • create a rotation for staff accessing sensitive data, so if data is leaked you will a) know who leaked it and b) still have the majority of your data secure
  • tightly control peripheral storage devices and monitor their usage
  • ban or closely monitor personal and company phone usage
  • do not allow information to be taken home by employees (obviously the WFH revolution has forced companies to relax this policy)
  • physically destroy old hardware that has been used to store company data, or ensure all drives are wiped using ‘degaussing’, a data destruction technique that leaves hardware intact
  • ensure you can trust your employees by performing background checks, and make them sign non-disclosure agreements – this can act as a deterrent and gives you, as an employer, legal recourse
  • store ex-employee’s hardware and scrutinise it for signs of illegal activity or inappropriate usage
  • keep sensitive data locked up and monitor access, ensuring any data accessed is used for legitimate purposes
  • encrypt hard drives to prevent people accessing the data on the computer if it is stolen; there are several software solutions that can be installed such as VeraCrypt or Window’s built in Encrypted File System.
  • constantly remind and train employees on security awareness, using meetings, training days, bulletins etc.

Any determined employee will be able to leak data from the company, but using the methods above will mitigate any harm and may even prevent the person from stealing your data in the first place.

The Industrial Espionage Act

The US passed a law in 1996 that made stealing trade secrets from companies a criminal act. You can read it here: https://www.congress.gov/bill/104th-congress/house-bill/3723/text/pl

Spear Phishing

  • Phishing – favours quantity over quality, e.g. sends out spam emails to a large amount of people to acquire data
  • Spear phishing – similar to phishing but targets a particular person, i.e., an employee at a certain company
  • Whaling – targets one individual and is designed to fool that one particular person into revealing secret information

Summary

Industrial espionage is a real threat and should be mitigated. All espionage methods should be thoroughly researched and defended against, but remember that your employees are the weakest point in your security. There is even a chance you yourself could be fooled in a whaling attack. Needless to say, implementing network security measures, using the least privileges principle, and using legal defences such as NDAs will limit your exposure.