Keep Your Eye on the Ball - “Trade Secrets”
Ellen Messmer's Computerworld article inspired me to reiterate that one of the first things companies must do to protect themselves and their future is to capture critical information at the point of origin, when it is first conceived. If there is not a system or process in place to manage sensitive information such as trade secrets, they will probably be up for grabs. Many well intended organizations fumble the ball at this critical stage and competitive information that drives profitability walks out the door and is lost forever.
Lifecycle management of the most critical organizational assets is a daunting task, but technologies are emerging to automate and semi-automate key process steps to accomplish effective management for security. They include: inventory, categorization, identification, classification, and valuation. The application of security controls is dependent on where the asset is in its lifecycle. The value may not be fully known at the time of creation so it would be advisable to apply the highest classification level at that time. Additional trade secret projects, products, and strategies are likely to emerge throughout the development phase, depending on the type of trade secret. This framework offers a better means to review and evaluate trade secrets to make decisions, which may include seeking protection under patent law. As trade secret ideas and innovations evolve toward production, they will likely be subjected to a wider distribution resulting in greater exposure and risk to confidentiality. Trade secrets may require evaluation for licensing and other profitability considerations. At some point in time, a trade secret may become obsolete.
Organizations can’t afford to merely react to what’s occurring around them. They must adopt a proactive information security management approach that will secure information assets from a broad spectrum of internal and external threats. This must be led by a dedicated champion such as a CIO or VP of technology who has the authority to obtain acceptance and commitment from communities of interest across the enterprise at all levels. Much interaction and cooperation is required to transform a framework into a blueprint that will be used to implement the security program.
We cannot stop the curve ball from coming our way, but we can stay in the game by keeping our eye on the ball.
David Drab
Principal, Information Content Security Services
Xerox Global Services