How to use Encryption and Privacy Tools to Evade Corporate Espionage An ICIT White Paper Institute for Critical Infrastructure Technology August 2015 NOTICE: The recommendations contained in this white paper are not intended as standards for federal agencies or the legislative community, nor as replacements for enterprise-wide security strategies, frameworks and technologies. This white paper is written primarily for individuals (i.e. lawyers, CEOs, investment bankers, etc.) who are high risk targets of corporate espionage attacks. The information contained within this briefing is to be used for legal purposes only. ICIT does not condone the application of these strategies for illegal activity. Before using any of these strategies the reader is advised to consult an encryption professional. ICIT shall not be liable for the outcomes of any of the applications used by the reader that are mentioned in this brief. This document is for information purposes only. It is imperative that the reader hires skilled professionals for their cybersecurity needs. The Institute is available to provide encryption and privacy training to protect your organization’s sensitive data. To learn more about this offering, contact information can be found on page 41 of this brief. Not long ago it was speculated that the leading world economic and political powers were engaged in a cyber arms race; that the world is witnessing a cyber resource buildup of Cold War proportions. The implied threat in that assessment is close, but it misses the mark by at least half. The threat is much greater than you can imagine. We have passed the escalation phase and have engaged directly into full confrontation in the cyberwar. State-sponsored hacking groups are regularly committing targeted and complex attacks against governments, businesses, and individuals. In this new reality there are two possibilities when it comes to your own personal/business data and the data of your clients. The first possibility is that you and your business are already breached in some way and have been for some time now. Somewhere in your system (at home, the office, your cellphone/tablet, or even your smartwatch) state-sponsored hackers from China, the Eastern Bloc, North Korea, or even Iran have placed software that allows them to quietly watch your every online move and record it all; thereby, stealing away information that provides them with a decided advantage in business negotiations or outright stealing intellectual property to copy it with impunity. Hacker groups like Anonymous, The Syrian Electronic Army, The Chaos Computer Club (Europe), and Tarh Andishan (Iran) may be siphoning off the your organization’s most treasured secrets for no other reason than to expose them to the world and embarrass those you protect. Further, compromised systems, potentially including every PC in your organization, are infected and their resources are used to assist in attacks against other organizations, such as dedicated- denial-of-service (DDoS) attacks. Your organization can be investigated by the FBI or carry liability for attacks made against other organizations from your network. In today’s climate bad actors are not always sitting half a world away. Often it is an employee whose laissez faire attitude or ignorance about basic cyber security methods brings down even the most sophisticated organization. Given the current state of the Federal cybersecurity landscape, odds are that there will be no white knights on charging steeds coming to your rescue anytime soon. They are going to be busy setting their own houses in order. More likely is that you will get more and more regulations to comply with and stiffer penalties to endure for failing to do so. The second possibility is that your organization is about to be breached and you have the opportunity to proactively prevent that occurrence. There is absolutely no chance that everything is just fine and you have nothing at all about which to be concerned. Unsuspecting targets and those who do not appreciate the threat are the most appealing victims. Everything is up for grabs in the escalating cyberwar. Are you willing to risk everything? Those perpetrating these attacks are interested in every detail they can collect and that includes the most mundane pieces of daily life. Some information is useful for decades, and other information, including expired records, can be fed into Big Data algorithms to generate valuable information. In a world of legal holds and incredibly long file retention requirements, legal organizations are a massive treasure hoard capable of sustaining those who breach them for decades. These bad actors are patient, well-funded (especially if they are state-sponsored), and have the strength of numbers on their side. Vandals and criminals pursue quick payoffs and easy returns but foreign governments value a broader palate of information and they have limitless resources and patience. Once attackers penetrate a system, they may continuously monitor the network in real time until they choose to act. Adversaries may even patch vulnerabilities behind them so that other parties do not also breach the system and set off alerts. Becoming discouraged at the possibility of a full-court press against your existing cybersecurity measures is exactly what these groups count on. Constant vigilance is the first block in a solid foundation to protecting yourself, your business, and your clients. In the following pages you will see that there is a combination of small steps that, when executed in concert, make your organization a much more difficult target to hit and thus less appealing to groups who often begin by looking for the easiest/fastest win they can get. This is by no means a talisman or magic bullet that will prevent all cyber-attacks, but often making yourself a more difficult target than your competitors is enough to mitigate most attacks. Attackers have breached 96% of organizations across all sectors, including Legal, Financial, Healthcare, Pharmaceutical, and Government, at some point in the past decade. According to Bloomberg Business, adversaries have breached 80 of the biggest 100 law firms, by revenue, since 2011. Clients are pressuring organizations to adequately protect their data under the threat of migration to another firm. No organization wants to publically admit that they their unprotected systems and cyber-apathy assisted the exfiltration of client intellectual property. Data is no longer solely safe behind the layered security supporting organizations because sophisticated actors, who cannot breach the defenses, will alter their strategy and target the employees supporting the organization instead of attacking the system directly. The most prevalent and by far the most successful attack vector against an organization is social engineering, the process where an attacker, bent on soliciting confidential information or minute organizational details, interacts with an employee person-to-person via email, phone, or real life. This process is akin to the big bad wolf knocking on the door and asking for a cup of sugar instead of trying to huff, puff, and blow the brick house down. Social engineering attacks, which range from stealing user login information to mapping the organizational structure, are so successful that if you think of a major breach that has appeared in the media in the past 5 years (Ashley Madison, Darkode, OPM, Target, etc.) there is almost a certain likelihood that the breach began as a social engineering attack. Simply, if an actor knows who you are, what you do, when you do it, where you browse online, why you interact online, and how you access the internet, then the actor literally knows or knows how to learn, every scrap of information necessary to steal your data, financial information, or intellectual property. Fortunately, employees can utilize many of the procedures and tools popularized by the nefarious lot to ensure the levels of privacy, anonymity, and security necessary to prevent personally targeted attacks. Every person in an organization should adopt these preventative measures to ensure organizational resiliency. When an attacker fails to gain entry with their initial target, most often they simply adjust their attack laterally or diagonally in an organization and repeat the endeavor until they achieve success. Blocking the ability to gain a foothold by creating an organizational culture of cybersecurity in this way makes yours a much more difficult target to attack. Data must be protected where it is accessed, where it is stored, and while it is in transit. An increasingly more mobile workforce requires secure access to data on personal computers and smartphones as well as the ability to navigate online without attracting the attention of malicious actors. Predators can be avoided if they never notice prey. Data stored on servers and personal computers must be protected and encrypted. More importantly, the data known to personnel must be protected by training employees to value security, privacy, and anonymity. Information can be securely transferred through encrypted email, encrypted telephony and text message solutions, and through end -to-end encryption solutions such as virtual private network (VPN) connections. Data that must be accessed through the use of mobile devices must be accessed through a containerized solution that keeps the data secured and away from the personal data and apps that a user also keeps on their device. This containerized segment may also be remotely wiped clean and remotely removed from a user’s device when a device is lost or stolen, or if the individual’s association with your organization is terminated. Enterprises can no longer consider best of breed solutions that are narrow in focus. Best of suite tools must be employed that allow data to be protected regardless of the platform and application used to access and interact with it. While this may sound like a daunting and expensive proposition do not be discouraged.