It was a connection to these externally based insiders that got Bailey, at the government contractor, in trouble. “The extranets pose a problem because many of them are controlled by program managers for the benefit of the customer,” says Bailey. “And that can make policy enforcement problematic.” But the focus on pleasing the customer backfired. “There’s nothing worse than having to call up your customers and say, Because of our negligence, we’ve compromised your proprietary information,” Bailey says.

The Counterintelligence Mind-Set
As hacking has grown more purposeful, the traditional IT security mind-set has failed to keep up. “There’s virtually unlimited information to protect and unlimited supply of threat and vulnerability,” says Motorola’s Boni. And there are no easy solutions. “Risk management oversight over distant suppliers is an emerging art,” Boni says.

The vast majority of IP loss incidents are simple errors: posting information to externally facing websites wrongly assumed to be protected or including confidential information in a reply to an e-mail that includes external recipients, says Boni. The most successful hacks, says Bumgarner, occur because attackers get lucky, stumbling across a vulnerability while scanning thousands of IP addresses. But the most dangerous attacks are deliberate.

To defend against targeted attacks, Motorola uses traditional controls such as firewalls, intrusion detection tools, antivirus software and digital forensics—but with a difference. “We’re operating our information security toolkit with a counterintelligence mind-set,” says Boni. Like the military, Boni assumes there’s an enemy looking for an advantage and it’s his job to outwit him. “Putting those tools together with an understanding of what is or could be of greatest interest to competitors allows a more granular focus on the data,” says Boni, “not just on the network.”

Boni partners closely with business units to attempt to forecast the risk to particular IP-related information. “Every product or service has market share and projected financials. We try to understand what pieces of information are the key contributors to that product or service and whether they are at risk to targeted attacks.”

More companies need to adopt this more nuanced approach, agrees O. Sami Saydjari, president of Cyber Defense Agency, a security consultancy. “They’ll hire white-hat hackers—doorknob turners who shake all your doors and tell you where they got in,” Saydjari says. “And the company will try to figure out where to close those vulnerabilities. That’s primitive analysis.” When Bailey, the government contractor, conducted penetration testing of his internal systems, the white hats delivered a five-inch-thick report of vulnerabilities. Bailey says he closed every hole, but he ignored the extranet. Nor did he have a comprehensive program for updating systems and installing patches. “The lessons learned from the exploit were not uniformly applied across the business,” says Bailey. “That was my mistake.”