Common corporate security and cybersecurity questions, answered by experts.

What is corporate espionage?

Corporate espionage, often referred to as industrial espionage, is the practice of intelligence collection between companies.  Different from traditional Business Intelligence or other forms of Open Source information collection, corporate espionage generally involves the theft of a competitors intellectual property, pricing strategies, or other types of proprietary information. 

Unlike corporate or industrial espionage, economic espionage is generally conducted by or on the behalf of a government. The government often then provides the intelligence gathered to domestic companies to create a competitive advantage in an international market. China, Russia, France, and Cuba all have active economic espionage campaigns targeting U.S. businesses. 

What is economic espionage?

What is a phishing attack?

Phishing is the most common form of cyber attack and is widely used by both criminal hackers and foreign governments to conduct corporate or economic espionage. A phishing attack is conducted by sending the target a fake, but convincing email. The target will likely open the email, potentially installing malware on their computer, or enter usernames, passwords, account numbers, or other sensitive data. The attacker then uses these compromised credentials to access the accounts of the victim. In our experience, 47% of people targeted in a phishing attack will open the fake email and provide sensitive data. 

Ransomware and Doxware are both forms of malware that are unknowingly downloaded onto a users' computer and/or network. Ransomware is designed to encrypt some, or all, of the data within a user's computer or network and then requires the user to pay the hacker in order to regain access to their data. Doxware is meant to search through a users computer or network to look for sensitive, proprietary, embarrassing, or compromising data. Once this data is found, the hacker then threatens to make the data public if the user or organization does not pay. As one can imagine, both forms of malware will leave any corporation in an unfortunate position. For more information on how to protect yourself against such attacks, please review our blog or reach out to one of our team members. 

What is the difference between ransomeware and doxware?

What is a penetration test?

A penetration test is an in-depth security evaluation of a facility or computer network. Penetration tests are also commonly referred to as red-team assessments. The term red-team is borrowed from the military and refers to a process when a group of people would play enemy forces during a war game to test and evaluate war plans.

A network penetration test starts with a vulnerability scan to identify weaknesses in network's defenses. The penetration tester, or white-hat hacker, then uses specialized tools to exploit the vulnerabilities discovered. The true mark of an good penetration tester is his ability to write custom computer code to exploit newly discovered vulnerabilities.

A physical penetration test often uses social engineering to convince people to allow you access to a sensitive facility or room. When combined, these two types of security evaluations provide an excellent picture of an organizations vulnerabilities and provides recommendations on how to mitigate them. 

Corporate counterintelligence is the most effective approach to protecting the sensitive data of a company. Each corporation has unique needs, however, the most comprehensive approach to protecting data addresses human, physical and cybersecurity. These three focus-areas form the core of counterintelligence and have been utilized by U.S. intelligence agencies and the military to protect our nation's most import secrets. At Bluestone Analytics, we are the leader in the corporate counterintelligence field, helping our clients apply the best security principles. Contact us to learn how we can protect your most sensitive data. 

What is corporate counterintelligence?

Open Source Intelligence (OSINT) is intelligence collected from publicly-available sources. Some examples are social media, print and online news sources, online forums, academic studies, commercially available satellite imagery, and the dark web. OSINT is highly useful when attributing cyber attacks, identifying potential corporate espionage threats, and identifying impending terrorist attacks.

What is OSINT?

Don't see your question?