This article can also be found in the Premium Editorial Download "Information Security magazine: Nine tips to guarding your intellectual property."
Download it now to read this article plus other related content.
Despite the increasing sophistication of technology, there's no magic bullet for protecting IP. "There is no absolute 100 percent foolproof way to protect trade secrets," says legal expert Sabett. "You could spend all your time and money on technological protections and yet your trade secrets could be flowing out of the organization in all sorts of other ways."
An effective protection program must include a number of strategies, including educating employees, contractors and partners about what constitutes trade secrets; establishing the right governance model (policies, roles and responsibilities, enforcement); process-level controls and procedural, physical and technical controls to minimize risk to a level acceptable by management.
The first step to protecting your trade secrets is to identify them through interviews with the business process owners and document them. Next, estimate how much these trade secrets are worth. Although this is just a snapshot that will change over time, it's essential for building a business case to obtain the funding to put protections in place. Having this valuation is also important should a theft actually occur. "It's a complicated process to do this, but a critical element for prosecutors," says the FBI's Schadler. Then, rank the trade secrets according to their value as well as the threats,
vulnerabilities and resulting risk.
A comprehensive education and awareness program is a critical step; some experts argue that it's the most important one. "Education and awareness is your first and foremost practical solution for protecting trade secrets," says Cisco's Burgess. Landwehr of Adobe agrees: "Whatever technology you decide to implement, it won't be effective unless you also have a plan to educate users."
Finally, your company should define programmatic, compliance and operational metrics to measure the performance of your trade secret protections against key indicators. Without the metrics, you will not know whether you are effectively protecting your trade secrets.
Everyone agrees: Not doing anything to protect your company's trade secrets is simply not an option anymore. The U.S. Department of Justice is making it a first order of business.
"The prosecution of IP theft cases--specifically trade secret theft and economic espionage--is a priority for the CHIP unit and is critical to the economy of Silicon Valley and indeed to the nation's security," says Parrella.
This was first published in May 2007