Is your organization's intellectual property floating around the Internet? Not sure? Here are some ways to check.
After reading how copious amounts of data pertaining to the Joint Strike Fighter and Marine One helicopter managed to escape, I decided I must be naive.
No way could that have happened. Yet terabytes of data flowed out to who knows where. If that can happen to top secret information, what hope do we have of protecting our intellectual property?
Being an optimist, I think there's lots of hope. But, the solution is going to require a shift in focus. It's time to concentrate on the data not the infrastructure, because that's ultimately what the bad guys are after.
What is intellectual property?
Before getting too much further in the discussion, I thought I'd better explain what intellectual property should mean to organizations.
While trying to figure that out I came across a CSO article by Derek Slater and really liked what he had to say. To begin with, Slater pointed out that the World Intellectual Property Organization considers intellectual property to be:
"Creations of the mind--inventions, literary and artistic works, symbols, names, images, and designs used in commerce. IP includes but is not limited to proprietary formulas and ideas, inventions (products and processes), industrial designs, and geographic indications of source, as well as literary and artistic works such as novels, films, music, architectural designs and Web pages."
Not much left to chance in that definition. Slater goes on to mention that there are four legally-defined categories of intellectual property, patents, trademarks, copyrights, and trade secrets. It's a pretty good bet that the bad guys will be focusing on the trade secrets group, so then should the people in charge of securing the company's intellectual property.
Safe or not?
It's not complicated to determine what should be considered intellectual property. The difficulty starts with trying to determine the status of the data, especially whether it's safely under control or on YouTube or some malicious Web site for the world to see.
The good news is that there are methods to determine if data leakage is occurring. One method is to use services like Brandprotect, which are specifically geared to protect the integrity of a company. But, they're expensive services and typically out of reach for most small and midsize businesses (SMBs).
I had thought those services were the only game in town until I read another CSO article by Brandon Gregg, where he presented several free solutions.
Monitor information leaks
The obvious method is to use search engines like Google to find any results that point to information leaks. The problem with using search engines is that the ensuing amount of data can be overwhelming. With so much data to inspect, it becomes easy to overlook pertinent hits. One option is to use Googlehacks to further refine your search parameters.
Google alerts
I prefer using Google alerts over generic searches, especially if detailed search terms (check the FAQs) are used. It can become a powerful automated tool that works in the background, sending an e-mail notification of any alert that's found.
Limewire
Limewire isn't specifically an application designed to search for content. It's a peer-to-peer (P2P) file sharing program.
Limewire recently came under some congressional scrutiny, when it was accused of being the delivery method used to transfer Marine One designs to a site in Iran.
I suspect the reason Limewire is under the microscope is because it's arguably the most popular P2P application in the world. Which is also why Limewire would be the logical choice to determine if any sensitive material is readily available on P2P networks.
To use Limewire, download and install the software on your computer. Please make sure to disable all file sharing. Then setup searches using key names that reference company or intellectual property in some way and see what shows up.
Monitter
Twitter is definitely controversial, especially in a business setting. Still, no matter what you think about it, it's a very powerful method to disseminate company information rapidly and if so desired with relative anonymity. Fortunately, Gregg found a unique solution.
Welcome to Monitter, a Web-based application that eavesdrops on the Twitter stream. It's easy to set up as Monitter's search functions are identical those used by Twitter, for more details check out the FAQs at search.twitter.com.
Similar to Google alerts, Monitter can be automated sending results as an e-mail message, RSS feed, or SMS text. I've introduced this to a few friends that are security administrators and they've already mentioned how surprised they are at the amount of company-related chatter on Twitter.
Addictomatic
Addictomatic is a rather unique application that crawls the Web searching a wide variety of sites, including popular blogs, YouTube, Digg, and even Flickr. All that's required is to enter a search term and Addictomatic will start working. Hopefully no real surprises will show up. I like how Addictomatic presents the results in a manner that's readily understandable.
Addictomatic is not automated at this time, but the developer has mentioned that an RSS feed will be added soon. Another useful feature is that Addictomatic can be added the Web-browser's search bar.
Final thoughts
Unwanted dissemination of valuable and or sensitive information can have all sorts of adverse effects, from simple embarrassment to destroying an organization's competitive advantage. Using the above simple techniques can help prevent or minimize the fallout from losing control of intellectual property.
Intellectual property: Do you have a leak?
