IT Security Assessments

Perhaps the most serious threat to an organization’s crown jewels originates from within. We separate internal threats into two categories: a) professional spies, and b) employees who became rogue at some point. Investigation of authorized users’ unauthorized activity requires special tools and techniques. We have successfully investigated all forms of insider threats regardless of the sophistication of the adversary. When people in the industry speak about APTs, they neglect to mention the possibility of APTs infiltrating organizations not via cyber-attacks, but by placing professional spies as employees. This is an ever-present danger and, on several occasions, our investigations have revealed that we were not simply dealing with employee misconduct, but with a calculated set of actions taken by an extremely skilled perpetrator.

We have successfully caught professional spies, as well as exonerated wrongfully accused employees. We have uncovered an employee working at a research and development section of a company launching attacks from his workstation on other researchers’ workstations to gain access to their programs and models. We have witnessed an employee installing ‘key loggers’ on other employees’ workstations. This broad range of situations has made us experienced, skilled, and well-equipped to deal with any form of internal threat regardless of the sophistication of the adversary.

The typical internal threat, however, is the employee’s desire to gain a competitive advantage on the marketplace or to attain more favorable employment. The theft of intellectual property is a mission that can easily be completed, often by copying someone else’s idea or product, or by stealing a company’s crown jewels. Organizations are generally ill-equipped to detect unauthorized activity by an authorized user. The vast majority of internal misconduct simply goes undetected. Those cases that are detected are generally identified either accidentally, or when it is too late. An employee may have a planned course of action to steal data over a long period of time or, more commonly, to begin copying sensitive data near their date of departure from the firm. Theft of intellectual property can reap terrible consequences for an organization, especially if the data reaches a competitor. Our investigators have consistently uncovered evidence of theft of intellectual property and trade secrets where the perpetrator(s) used advanced tools to conceal their actions.