David Cronkright Chuck Dudinetz Paul Jones Corporate Auditing The Dow Chemical Company February 16, 2012 Auditing Protection of Intellectual Property

Agenda About Dow What is IP and why do we care? Whats the risk? What are the key controls? How do we audit information protection controls? Questions & Answers

Agenda About Dow What is IP and why do we care? Whats the risk? What are the key controls? How do we audit information protection controls? Questions & Answers

IP is an asset to be protected… Technology Business intelligence Personal Data What is IP and why do we care?

IP can take a number of forms… Explicit –Electronically stored –Hardcopy –The object itself Tacit –Conversations –Presentations What is IP and why do we care?

Loss of IP can have significant consequences… –Loss of competitive advantage loss of business –Loss of licensing revenue –Loss of prospective M&A partner –Non-compliance with legal/regulatory requirements –Damage to reputation –Sabotage What is IP and why do we care?

About Dow What is IP and why do we care? Whats the risk? What are the key controls? How do we audit information protection controls? Questions & Answers Agenda

Whats the risk ? Risk = Threat x Vulnerability x Consequence

9 Whats the risk ?

Threats… Industrial Espionage Targeting & recruitment of insiders Cyber intrusions Dumpster diving Establishment of business relationships … Increasingly highly organized, funded, and resourced Hacktivism Politically or socially motivated Cause reputation damage Cyber Crime Profit motive Whats the risk ?

Potential Vulnerabilities… Inherent vulnerabilities Targeted industry ? Geographic presence Company culture Culture of trust ? Collaborative culture ? Education & awareness Weak policies & procedures … translate to behaviors Whats the risk ?

Potential Vulnerabilities (Contd) … Workforce dynamics Outsourcing Turnover Hiring practices Employee morale Facility Weak physical security Multi-tenancy 3 rd Party service providers Open work space Waste segregation and disposal Poor handling of printed documents, portable media Whats the risk ?

Potential Vulnerabilities (Contd) … I/T Weak computer room security Broadly accessible network ports Unsecure data transfer Inappropriate access to electronic repositories Network perimeter Susceptibility to malware Whats the risk ?

About Dow What is IP and why do we care? Whats the risk? What are the key controls? How do we audit information protection controls? Questions & Answers Agenda

Controls : Mitigate the likelihood and/or impact of the threat exploiting a vulnerability What are the Controls ?

Governance Assessing Risk Organization design/steering Communication Monitoring Preventive Secure the network perimeter (Firewalls, IPS) Secure the data (repository-level access control, DRM, DLP) Physical security (badge access) Confidentiality agreements Workforce education (culture, behaviors) Secure disposal of media (including hardcopy) Contractual verbiage/third party assurance (for outsourced data) What are the Controls ?

Detective –Intrusion detection (NIDS, HIDS) –Critical log review –Workforce monitoring (behavior changes, hoarding data) –Monitoring of information extraction/downloading What are the Controls ?

Preventive Detective I/T Non-I/T Information handling policies Confidentiality agreements Background checks Layering of Controls Workforce onboarding & offboarding Workforce behavior monitoring Badge access Work area segregation Clean desk policy Locked cabinets Document & media disposal Computer room security Secured network ports Encrypted data transfer Data Loss Prevention (DLP) Firewalls Intrusion Prevention Antivirus Information access monitoring Patching Intrusion Detection Information classification I/T access control - Repository level - Data level (DRM) Strong passwords Elevated access Network segmentation Egress traffic Security incident response Logging - Capture - Retention - Analysis Vulnerability scanning Asset identification & inventory Application whitelisting Workforce offboarding Employee education Physical security surveillance Investigative processes Vehicle inspections

–Network Perimeter audits Common Network access points VPN/RAS, Firewalls/Proxy Servers, Circuits, Modems, Physical Controls –Intellectual Property specific audits Where the data lives (ex: Crown Jewels) Site, Application, Project specific or Hybrid –Cyber Security audits Organizations ability to sense and respond to changing threat landscape Governance and Control assessments –Integrated audits (strategy going forward) How do we audit information protection controls ?

Network Perimeter Audit Preventive Detective I/T Non-I/T Information handling policies Confidentiality agreements Background checks Workforce onboarding & offboarding Workforce behavior monitoring Badge access Work area segregation Clean desk policy Locked cabinets Document & media disposal Computer room security Secured network ports Encrypted data transfer Data Loss Prevention (DLP) Firewalls Intrusion Prevention Antivirus Information access monitoring Patching Intrusion Detection Information classification I/T access control - Repository level - Data level (DRM) Strong passwords Elevated access Network segmentation Egress traffic Security incident response Logging - Capture - Retention - Analysis Vulnerability scanning Asset identification & inventory Application whitelisting Workforce offboarding Physical security surveillance Investigative processes Vehicle inspections Employee education

Intellectual Property Audit Preventive Detective I/T Non-I/T Information handling policies Confidentiality agreements Background checks Workforce onboarding & offboarding Workforce behavior monitoring Badge access Work area segregation Clean desk policy Locked cabinets Document & media disposal Computer room security Secured network ports Encrypted data transfer Data Loss Prevention (DLP) Firewalls Intrusion Prevention Antivirus Information access monitoring Patching Intrusion Detection Information classification I/T access control - Repository level - Data level (DRM) Strong passwords Elevated access Network segmentation Egress traffic Security incident response Logging - Capture - Retention - Analysis Vulnerability scanning Asset identification & inventory Application whitelisting Workforce offboarding Physical security surveillance Investigative processes Vehicle inspections Employee education

Much more than just I/T controls Sense and respond approach (peripheral vision) Consider effectiveness of controls as a whole –Layering of controls –Audit judgment required Position to avoid pre-audit window dressing Finding broader issues Intellectual Property Audit - Learnings

Cyber Security Audit Preventive Detective I/T Non-I/T Information handling policies Confidentiality agreements Background checks Workforce onboarding & offboarding Workforce behavior monitoring Badge access Work area segregation Clean desk policy Locked cabinets Document & media disposal Computer room security Secured network ports Encrypted data transfer Data Loss Prevention (DLP) Firewalls Intrusion Prevention Antivirus Information access monitoring Patching Intrusion Detection Information classification I/T access control - Repository level - Data level (DRM) Strong passwords Elevated access Network segmentation Egress traffic Security incident response Logging - Capture - Retention - Analysis Vulnerability scanning Asset identification & inventory Application whitelisting Workforce offboarding Physical security surveillance Investigative processes Vehicle inspections Employee education

External Threat – Cyber Security It use to be that each company was its own little cyber kingdom and physical access was the king of control for external threats Thanks to the internet - everything touches everything so vulnerabilities have increased The number, ability and motives of external threats are also increasing Updated External Threat audit programs two years ago

External Threat – Cyber Security While press releases of APT compromises were out there little else was available on APT what and how Lacked expertise / experience to understand threat termed APT (Advanced Persistent Threat) Researched several firms specializing in APT The project looked at the threat, its motives, processes used to compromise a target and the controls required to slow down, detect and eradicate it.

External Threat – Cyber Security The APT is real and has more time and money to get at your IP than you have time and money to secure it. It is a paradigm shift from a controls perspective. The logic is They will get to your data…. Preventive controls are there to slow them down so detective controls have time to identify the breach. Proper response is required to assure you get all of the comprise before they know youre on to them. To date espionage has been the primary objective

External Threat – Cyber Security Results - Two high level audit programs and insight into the new breed of Cyber Threat Governance Organization & strategy Key Relationships Training and Awareness Establishing the bar; COSO observations Control Assessment Preventive Detective Response

About Dow What is IP and why do we care? Whats the risk? What are the key controls? How do we audit information protection controls? Questions & Answers Agenda