Cyber-security or general protection of IPCI
Some time ago a friend in the U.K. sent us a paper on cyber losses of intellectual property and critical information (IPCI). As best as we could discern, losses because of computer issues amounted to a not-insignificant seventeen percent of the total IPCI losses. This seventeen percent was enough to demand well over ninety percent of the funds spent overall to protect IPCI.
The more mathematically astute may feel that the response is somewhat disproportionate. And that more than ten percent of the resources should have been devoted to the other eighty-three percent of non-computer related losses.
While this might seem to be the case – actually, it is the case – in truth there are a number of psychological reasons for the disparity. For a start, security is generally aimed at protecting things on the inside from people on the outside. Firewalls, anti-malware software, and other such defenses fall into this mold and are therefore comprehensible and reasonable to those making such decisions. And while these prophylactic measures are mainly aimed at stopping the destruction caused by malware and cyber-attackers, they also prevent some loss of IPCI as a sort of unintended side benefit.
For the rest, corporate security is also generally aimed and protecting what is inside from what is outside, with all the rest – which is where the action is – generally ignored.
However, while it may be being ignored in the real world, it is not being ignored in the movies. When we recently saw the Tony Gilroy movie Duplicity, which is about corporate spies, we practically fell out of our seats when one of the characters mentioned that the OPSEC team was coming in to investigate. While we have seen many companies with competitive intelligence groups, we have never encountered a company with an OPSEC, or counter-intelligence group.
The movies, however, often condition society as to what is appropriate and inappropriate behavior. Duplicity may be a precursor to American businesses taking the $300 billion avoidable annual loss of IPCI more seriously. Or not.