Protecting Knowledge Assets – Case & Method for New CISO Portfolio GRC-R10 Protecting Knowledge Assets – Case & Method for New CISO Portfolio Jon Neiditz Kilpatrick Townsend & Stockton LLP jneiditz@kilpatricktownsend.com @jonneiditz Dr. Larry Ponemon Darin Anderson Jeffrey Carr Ponemon Institute research@ponemon.org @ponemon CyberTECH darin@cyberhivesandiego.org @darinandersen Taia Global, Inc.; Suits and Spooks jc@taiaglobal.com @jeffreycarr

Understanding the risk to knowledge assets

The Study The Cybersecurity Risk to Knowledge Assets was conducted to determine whether the publicity accorded data breaches subject to notification laws has skewed the focus of organizations away from the theft or loss of their most critical information, and to provide helpful practices to reduce the risk. Knowledge assets are confidential information critical to a company’s core business ̶ other than personal information that would trigger notice requirements under law. More than 600 individuals familiar with a company's approach to managing knowledge assets and involved in the management process were surveyed.

* Theft Is Rampant 74% of respondents say that their company likely failed to detect a data breach involving the loss or theft of knowledge assets 60% state one or more pieces of their company’s knowledge assets are likely now in the hands of a competitor

Companies Don’t Know “What” or “How” * Companies Don’t Know “What” or “How” 31% of respondents say their company has a classification system that segments information assets based on value to the organization 28% rate their companies’ ability to mitigate the loss or theft of knowledge assets by insiders and external attackers as effective

Bigger Risks Invisible to C-Suites & Boards * Bigger Risks Invisible to C-Suites & Boards 59% say a data breach involving knowledge assets impacts their company's ability to operate as a going concern 53% replied that senior management is more concerned about a data breach involving credit card information or SSNs than the leakage of knowledge assets

Only 32 percent of respondents say their companies’ senior management understands the risk caused by unprotected knowledge assets, and 69 percent believe that senior management does not make the protection of knowledge assets a priority. The board of directors is often even more in the dark. Merely 23 percent of respondents say the board is made aware of all breaches involving the loss or theft of knowledge assets, and only 37 percent state that the board requires assurances that knowledge assets are managed and safeguarded appropriately. Heads in the Sand 69% believe that senior management does not make the protection of knowledge assets a priority 37% state that the board requires assurances that knowledge assets are managed and safeguarded appropriately

Do you believe your company’s knowledge assets are targeted by nation state attacks?

The main motivations of attackers who steal a company’s knowledge assets 1 = most likely to 4 = least likely

The most likely root causes of data breaches 1 = most likely to 4 = least likely

Employee and third-party negligence puts knowledge assets at risk Strongly agree and Agree responses combined

Why is your company effective in protecting knowledge assets? More than one choice permitted

Why is your company not effective in protecting knowledge assets? More than one choice permitted

How to protect knowledge assets

6 Key Components of Action Planning 1. Governance 2. Data Classification 3. Security Infrastructure 4. Employees 5. Vendor Management 6. Coverage Senior Management/ Board Involvement Establishment of Responsibility Identify and Prioritize Knowledge Assets Safeguards Detection Response Awareness and Education Identity & Access Management Departing Employees Cloud Security Contractor Access Risk Allocation Cyber-Risk Other Coverage

AD 2. Data Classification: Examples of Restricted Knowledge Assets/Trade Secrets Test Records Alliances Sales Forecasts Techniques Customer Purchasing History Future Store Locations Models Customer Profiles Strategic Business Plans Supplier Lists Blueprints Formulas Recipes Designs Methods Of Manufacture Procedures Quality Control Data Source Code *

2. Data Classification: The “Golden Record” Golden Record = compilation of customer data gathered across numerous sources, stored in one place (e.g. website, store loyalty cards, contests, events) The “Golden Record” may constitute the jewel in the crown of many of our customers knowledge assets. Develop compliant big data arrangements that enhance and protect such critical customer records, and give companies broad rights to use such data Conduct initial survey to determine key data streams and current rights in such data, document data inventory. Develop proposed data rights based customer’s data strategy, regulatory requirements, industry standards, and business goals.

2. Global R&D Spending Shows Emerging Valuation of Networks Source: Jeffrey Carr

3. Security Infrastructure: Administrative, Technical & Physical Data classification based on risk Build data classification into levels of security safeguards Encryption and/or tokenization “Least Privilege” principle and role-based access Assure detection systems are focused on most important knowledge assets Intrusion Data loss prevention, preventing exfiltrations Copy protection and embedded codes to trace copies Restrict downloading of sensitive company information Assure incident response programs fully incorporate knowledge assets

The most important security technologies for protecting knowledge assets Eight choices permitted

Questions?