IP theft – the pilfering of intangible assets that provide competitive advantage – is one of the costliest kinds of cyberattacks – learn how to protect against it
By The Mimecast Cyber Insights Blog Team ·
Key Points
Digitization has made intellectual property (IP) theft easier and less detectable.
The loss of corporate IP can be much costlier than the loss of personal or financial data.
Many organizations do not focus enough effort on protecting IP from insider threats and external attack.
Stealing intellectual property (IP) for profit or power is hardly a new phenomenon. This criminal practice is as old as the concept of IP itself. In the 1700s, British law first established the idea that creations of the mind (say, inventions or writing) are valuable assets worthy of legal protection. Since then, though governments have introduced and continually updated legislation protecting various classes of IP (such as patents or copyrights), digital technology has also made it easier to appropriate IP.
In the digital era, IP is a major target for cybercriminals – typically more lucrative than the relatively petty theft of individual credit card numbers or personal information. Enterprising cyber thieves and criminal gangs can sell corporate IP such as patented innovations or trade secrets to company rivals. In many cases, investigators have traced IP crime to state-sponsored groups linked to nations seeking to give their own industries a leg up or looking for information to aid in cyberwarfare.
Organizations can take steps to block these cyber thieves. Among the means at their disposal are email security and data loss prevention tools such as Mimecast’s, which automatically detect and stop the illicit movement of your organization’s intellectual property.
What Is Intellectual Property Theft (IP Theft)?
Intellectual property theft is when a person or organization steals an idea, creative expression, or invention from another person or organization.
Intellectual property theft, or IP theft, happens when unique ideas, inventions, or other proprietary information are taken or used without permission.
With the world moving into a knowledge-worker-based economy, companies derive less and less value from widgets and more from the processes, ideas, and innovations they create – their IP.
IP doesn’t live in static databases. It’s what your marketing teams create daily, what your product designers are mapping, and what your engineers are building. It lives on endpoints and in various cloud applications and may include source code, go-to-market plans, customer lists, and CAD drawings.
IP Theft Costs Hundreds of Billions Per Year
The Commission on the Theft of American Intellectual Property (IP Commission) estimated that intellectual property theft costs the United States economy approximately $600 billion annually. One multiyear cyber operation run by a Chinese state actor was estimated to have stolen trillions in IP (including sensitive documents, blueprints, diagrams, formulas, and manufacturing-related data) from 30 multinational companies operating in the energy, manufacturing, and pharmaceutical sectors, according to a 2022 report. In a recent global survey, C-level leaders ranked the impact of intellectual property theft as second only to the operational disruption caused by .
But while organizations are ever more aware of the risks and costs of customer or personal data theft, they often overlook the potential havoc that IP theft can wreak. There are fewer cyber regulations and less compulsory reporting around IP theft and, as a result, many organizations may fail to put the same effort into protecting what are some of their most valuable assets, leaving IP more vulnerable than, say, personal and financial information.
Types of Intellectual Property
IP refers to a broad range of assets that create value for an organization, from logos and client lists to product blueprints and go-to-market strategies. These so-called intangible assets (as opposed to tangible assets like goods, equipment, or cash) increasingly make up the majority of many organizations’ overall value. Intangible assets account for 90% of the S&P Index’s total assets.
There are four basic categories of IP:
Copyrighted materials: Books, art, and software can be protected by copyright by individuals or organizations. Copyrights protect their use by others without explicit permission.
Patented material: Inventors secure patents to protect their innovations, typically preventing others from profiting from their unique ideas for 20 years.
Trademarks: Organizations can get trademark protections for words, phrases, symbols, designs, or any combination thereof that identify and distinguish their brands of products and services.
Trade secrets: This broad category refers to confidential information that gives organizations some competitive advantage. This could be a production system, a strategy, or even a client list.
Methods of Intellectual Property Theft
Once upon a time, would-be IP thieves would have to pinch a physical artifact (say, a blueprint or a customer list) to achieve their nefarious aims. Digitization has turned IP piracy into a largely virtual enterprise, accomplished much more cheaply and quickly. Any digital IP is at risk. And given that organizations often collaborate broadly with third parties, the vulnerability is even greater. Copyrighted material and trade secrets are the types of intellectual property that are most likely to be targeted by cybercrime.
Digital piracy of copyrighted films, music, and more took off a few decades ago in the absence of any real regulation. But even in a regulated environment, digital advances in streaming and file sharing have continued to fuel piracy.
Outside of the media industry, the theft of trade secrets is most concerning. The peril grows exponentially once one person has access to, say, an unprotected trade secret. In many cases, organizations that must share their valuable IP with outsiders ask third parties to sign non-disclosure agreements as a way to protect the sensitive data. However, the agreements offer little protection against the threat of insiders stealing intellectual property, leveraging their specific understanding of systems and access to valuable IP.
According to Mimecast’s State of Email Security 2022 report, 93% of respondents said their organizations had experienced internal threats or data leaks initiated by compromised, careless or negligent employees over the previous 12 months, and nearly half (46%) said the threats or leaks had increased. The connection between IP theft and the insider threat played out in the headlines when an Alphabet engineer was sentenced to 18 months in prison for the alleged theft of trade secrets from his former employer.
This kind of criminal abuse of privilege is a primary method of IP theft. However, IP can also be stolen using other cyberattack methods, such as planting malware designed to read and exfiltrate data from computer memories. It can also be traced to human error.
Common IP Theft Scenarios
While stealing private data like a patent through data exfiltration may be the first example of IP theft that comes to mind, there are numerous ways it can occur.
Here’s a closer look at the four most common IP theft scenarios:
Insiders
IP theft from insiders happens when employees take sensitive information without authorization, whether intentional or not. When employees depart your organization for their next job, there is a 1 in 3 chance they take IP with the . The fear of unemployment or the desire to secure a competitive advantage in their next role may lead some individuals to misappropriate intellectual property, underlining the critical need for data protection measures within companies.
Human Error
One behavior that leads to IP theft is the insecure use of cloud services or applications due to human error. If an employee uploads data to a cloud service and exposes it by making it publicly viewable, it becomes available to anyone with an internet connection.
Additionally, the intermixing of company applications and storage services with personal devices and services is a common vector for IP theft, as personal devices are black holes for most security and IP tracking systems.
Access Exploitation
Unlike when employees inadvertently expose IP to theft, some may deliberately steal data.
Corporate spies – i.e., employees who use espionage techniques for commercial or financial purposes – or workers stealing data for their own use may seek out sensitive information from file shares hosted by corporate servers. Similarly, disgruntled employees who have put in their notice to quit might intentionally leak private business data to competitors to take revenge on their soon-to-be former employer.
Hackers
Malicious actors outside an organization, like hackers, don’t typically steal IP, but it happens occasionally. They use phishing or other social engineering attacks to steal regulated data like Personally Identification Information (PII) and credit card details that they can monetize by impersonating individuals.
How to Monitor and Detect Potential Intellectual Property Theft?
The best way to monitor and detect potential intellectual property theft is through the use of cybersecurity technology. Organizations who cannot detect cyberattacks will never know when their intellectual property has been at risk of being stolen. With a strong cybersecurity program, organizations will know when they have been breached, and they will know what information, including intellectual property, has been stolen.
7 Tips for Intellectual Property Protection
Identify your most valuable intellectual property.
Identify cybersecurity gaps at your organization.
Review who at your organization has access to intellectual property.
Develop a data security policy.
Be sure to monitor employee activity in relation to intellectual property.
Prevent all potential incidents as frequently as possible.
Educate your employees about intellectual property and potential theft.
Protecting Crown Jewels from IP Theft
Some large organizations have technology, personnel, and processes devoted specifically to IP protection, with zero trust security architectures in place. But the average organization may not have dedicated resources to protect these valuable assets. Leaving IP vulnerable to theft is a significant risk, but one that any organization can work to mitigate. Organizations can take the following steps to identify, classify, and protect their IP:
Inventory your IP: It sounds straightforward, but many organizations have not taken the time to determine just what IP sustains their competitive advantage and might be targeted for IP theft. Identifying these crown jewels is a critical first step.
Locate your IP: Once you’ve identified these assets, it’s time to figure out exactly where they reside. Hint: They may exist in more than one location – on-premises data centers, cloud applications, employees’ personal devices and third-party systems, for a start. Email systems are usually a treasure trove of company information. Only after this IP mapping exercise can an organization put in place the best policies, procedures, and technologies to prevent IP theft.
Review IP access: Many internal and external individuals may have access to your IP. Performing an audit of who has access to sensitive IP and limiting that access on a need-to-have basis will substantially lower the risk of IP theft. Don’t forget to include employees and partners who are no longer working with the organization, since these former insiders can become weaponized in an IP-focused cyberattack. You can also consider IP management software to control IP access.
Educate and train employees: Next, it’s important to make sure that all employees and external partners or contractors understand what IP needs protecting and what their role is in doing so.
Defend against the insider threat: Whether due to ill intent or ignorance, employees can be a primary vector for IP theft. Securing digital communications channels – especially emails – should be a top priority. Organizations can invest in an insider threat management solution. Leading-edge email security software can continually monitor, detect, and remediate the threat of IP theft across the email network, including those that originate inside the organization. The right tools can remove emails that pose an insider threat or contain at-risk data like IP as while also checking for malware.
Establish and maintain a robust cybersecurity posture: Organizations that want to protect their organizations from cyberattacks, including those focused on IP theft, will implement the latest cybersecurity and threat intelligence tools and processes. Organizations should continually check for gaps in their security protocols to make sure that attackers stay away.
For those organizations that discover they have already been the victim of IP theft, speed is of the essence. As the IP Commission has warned, damage from stolen IP can accrue quickly.
The Bottom Line
While big consumer data breaches tend to dominate the headlines, the quieter crime of IP theft can have even more deleterious consequences for organizations. To prevent IP loss, organizations need to take action to identify and protect valuable IP, fortify cybersecurity protections, address the insider threat, and educate and train employees. Read on to find out how Mimecast’s insider threat management solutions can help.
Intellectual Property Protection FAQs
Is IP Theft a Crime?
Intellectual property theft is a serious crime. Most cases fall under federal jurisdiction, making them federal crimes. Companies that catch IP theft can take legal action, leading to penalties like fines, imprisonment, license suspension, and more.
The History of IP Theft
IP theft traces back a few centuries when the Copyright Act of 1709 laid the groundwork for patents and copyrights. While Thomas Edison may not have been the first to invent the phonograph, but he secured the patent before Charles Cros – which made all the difference in defining history. IP theft has transitioned from stealing manufacturing processes during the industrial revolution to modern-day cybersecurity risks, showcasing the fluid nature of intellectual property theft.
What Is Intellectual Property in Information Security?
Intellectual property in information security refers to any proprietary intangible asset that is not a physical object but has value.
What Role Does Cybersecurity Play in Protecting Against Intellectual Property (IP) theft?
Cybersecurity can help organizations identify when important data, including intellection property, has been stolen.
Can Employee Training Help Prevent IP Theft Within an Organization?
Yes. Employee training puts employees on alert to look for business information compromises that can lead to intellectual property theft. Employees should be well-versed in their organization's intellectual property, its value, and the ways in which people may be attempting to steal it.
How Can Endpoint Security Solutions Help Protect Intellectual Property from Cyber Threats?
Endpoint security solutions help guard an organization's endpoints against unauthorized access. By doing so, they can help reduce the likelihood of cyber threats being successful. This helps to safeguard an organization's intellectual property.
Subscribe to Cyber Resilience Insights for more articles like these
Get all the latest news and cybersecurity industry analysis delivered right to your inbox
Loading form
How to Stop Intellectual Property Theft | Mimecast
