When it comes to your company’s research through open collaboration, who can you trust? 

(It’s a big question, we know.)

America’s research enterprise continues to deliver immense benefits for our health, economy and national security—but it’s under attack.

Eric Lander, former director of the White House Office of Science and Technology Policy (OSTP), explained the importance of having strong national R&D programs. 

“We’ve led the world for two key reasons: because we invest heavily, and because we do science openly,” he said. “This openness matters a great deal—and there’s strong bipartisan support for it.”

Doing science openly leads to several positive outcomes:

Mr. Lander also added a warning:

“It has become clear, though, that some foreign governments, including the Chinese government, are working vigorously to illicitly acquire, and in some cases outright steal, U.S. research and technology. There have been efforts to induce American scientists to secretively conduct research programs on behalf of foreign governments or to inappropriately disclose non-public results from research funded by U.S. government sources. Such threats are real, serious, and completely unacceptable.”

Which brings us back to the initial question: Who can you trust?

In this article, we’ll take a high-level look at the specific threat from the People’s Republic of China (PRC) and other more general security threats—as well as ways to protect yourself against those risks. For an in-depth review of these topics, check out our free white paper: Securing the Future of Academic Research.

Combating the threat from the PRC government

China has been vocal about seeking to advance its technological capabilities through international collaboration and research partnerships (such as its “Made in China 2025” initiative). It’s important, however, to read its statements with a healthy dose of skepticism, because the Chinese government is also known to target any person from any national origin who has expertise in a field that it deems necessary for self-reliance and national strength.

Consider the directive from Xi Jinping, President of the PRC, for his country’s scientists to “not forget their original intention, keep the mission firmly in mind, and adhere to the supremacy of the national interest. … Science has no borders, but scientists have motherlands.” 

So while the US research enterprise thrives on openness and collaboration to add diverse perspectives and accelerate innovation, these same qualities can also make it vulnerable to exploitation by China and other foreign entities.

In 2021, the United States government took action to combat potential vulnerabilities, creating National Security Presidential Memorandum 33 (NSPM-33). This directive aims to safeguard federally funded research while still fostering international collaboration and academic freedom. 

Understanding NSPM-33

NSPM-33 provides detailed guidance for federal agencies and research organizations (such as public and private universities, national laboratories, or any private company receiving federal grants for R&D projects) on implementing these protections effectively.

Here’s a quick rundown of the most important aspects from NSPM-33:

Proactively leading the way in research security

Once you understand what the threats are and why the guidance within NSPM-33 is critical, the next step is determining how to implement practical measures to protect your research organization. Consider these recommendations:

(For more ideas on how to establish secure and compliant research partnerships, check out this recent blog post.)

As compliance with NSPM-33 becomes increasingly important, those institutions that proactively lead the charge in research security will influence best practices across the sector, ultimately shaping the future of academic research.

For a deeper dive into China’s tactics, download the full white paper—or you can book a demo now to see how Strider’s security solutions can protect your most valuable assets.

Russia’s strategies for sustaining its technological edge and navigating economic isolation have drastically shifted in recent years, particularly since the war in Ukraine.  

During our recent webinar, Navigating the New Geopolitical Reality, Strider intelligence specialists delved into the findings from our latest white paper and shared actionable insights for organizations to safeguard their operations.  

If you missed it, here are five key themes we explored. 

1. Technological Sovereignty: Russia’s Driving Ambition 

One of the central themes discussed was Russia’s pursuit of “technological sovereignty.” This concept underscores Russia’s effort to reduce its reliance on foreign technologies and talent, a challenge exacerbated by sanctions, export controls, and a significant brain drain. 

To achieve these goals, Russia has intensified efforts to recruit foreign talent, leverage academic connections, and invest in domestic reverse engineering projects. As a Strider intelligence specialist highlighted, “Russia’s push for technological sovereignty isn’t just about survival—it’s a long-term strategy to dominate key industries.” 

2. Reverse Engineering as a Strategic Pillar 

Reverse engineering emerged as a critical focus area in the discussion. Russia has been using funds from its “exit tax” on departing foreign companies to finance reverse engineering projects aimed at replicating Western technologies. These efforts, often coordinated with intelligence agencies, target industries like defense and high-tech manufacturing. 

A Strider expert noted, “The integration of intelligence services into reverse engineering projects allows Russia to weaponize this knowledge, not just for domestic use but also to compete in global markets. The partnership between Russia and Iran further amplifies the risks.” 

3. The Shift in Espionage Tactics 

Sanctions and diplomatic restrictions have disrupted Russia’s traditional intelligence networks, leading to a reliance on unconventional methods. Strider intelligence specialists explained that Russia increasingly recruits individuals already living in Europe and leverages online platforms like LinkedIn to target potential assets. This shift toward “non-official covers” has made it harder for organizations to detect and mitigate risks. 

The team emphasized that “Strider’s intelligence solutions are uniquely positioned to uncover these connections, flagging risk signals tied to individuals and entities with potential ties to state-sponsored activities.” 

4. Gray Zone Operations: Beyond Espionage 

The webinar also explored Russia’s “gray zone operations,” which encompass sabotage, vandalism, and cyberattacks targeting countries and organizations supporting Ukraine. These low-cost, high-impact tactics aim to sow fear and undermine cohesion within NATO and the EU. 

A Strider expert highlighted, “Russia’s gray zone tactics blur the lines between traditional and unconventional warfare, making it essential for organizations to stay vigilant and proactive.” 

5. Sanctions Evasion: A Persistent Challenge 

The discussion wrapped up with insights into Russia’s sophisticated sanctions evasion networks. Despite stringent export controls, Russia continues to acquire critical technologies through intermediaries in countries like China and Turkey. The upcoming EU enforcement of “No Re-Exports to Russia” clauses in 2025 was highlighted as a key development to watch. 

A Strider specialist observed, “Sanctions are like a game of whack-a-mole—just as one network is disrupted, another emerges. The private sector plays a critical role in staying ahead by conducting rigorous supply chain due diligence.” 

How Strider Can Help 

The webinar underscored the importance of leveraging strategic intelligence to mitigate risks posed by state-sponsored actors. Strider’s platform combines advanced analytics with exclusive data to provide unparalleled visibility into supply chain vulnerabilities, personnel connections, and other risk factors. 

As a Strider intelligence specialist put it, “Every organization has unique challenges, and Strider is here to help you tackle them at scale.” 

Next Steps 

For a deeper dive into these insights, we encourage you to: 

If you’d like to discuss how these themes specifically impact your organization, schedule a consultation here.  

Together, we can navigate these challenges and protect what matters most. 

SCHEDULE A CONSULTATION

This is the fourth post of four in our Research Security blog series. To read the previous post, click here.

Introduction  

As the landscape of global research becomes increasingly complex, it is becoming more important to adopt best practices for ensuring research security. These practices not only protect intellectual property but also help maintain compliance with regulatory standards and safeguard national interests.  

This blog outlines best practices for establishing secure and productive research partnerships, with a focus on mitigating risks associated with collaborations involving the PRC. 

Know Your Partner Organization  

Before entering into any partnership, conduct thorough due diligence to assess potential risks. Key indicators to consider include: 

Know Your Partner Key Persons  

It is crucial to assess the backgrounds of key individuals involved in the partnership. Key indicators to consider include: 

Define and Adhere to Partnership Scope  

Clearly define the scope of the partnership to limit the potential for strategic information transfer and talent loss. Consider the following: 

Implementing Strategic Security Measures 

By employing sophisticated data analysis and risk assessment tools, academic institutions can pinpoint potentially hazardous collaborations. These measures not only secure research activities but also ensure compliance with necessary regulations, protecting funding streams and maintaining a competitive edge. 

Advanced platforms like Strider offer detailed insights into potential collaborators and key individuals, enabling institutions to perform rigorous due diligence. This proactive approach helps identify and mitigate risks, ensuring that research partnerships remain secure and productive. 

Conclusion  

Adopting best practices for research security is essential for protecting intellectual property, maintaining compliance, and safeguarding national interests. By leveraging Strider’s advanced intelligence capabilities, institutions can establish secure and productive research partnerships that drive innovation while mitigating risks. 

This is the third post of four in our Research Security blog series. To read the previous post, click here.

Introduction  

In an interconnected world, the security of research activities has far-reaching implications. The lack of robust research security measures can lead to significant global repercussions, affecting everything from national security to economic stability. This blog explores the global effects of inadequate research security, particularly focusing on the actions of the PRC and Russia, and highlights the importance for academic institutions to maintain compliance to secure and protect funding. 

Scope of the Challenge  

Research security breaches are not isolated incidents; they are part of a broader strategy by certain state actors to gain competitive advantages. The PRC and Russia, in particular, have developed sophisticated methods to exploit vulnerabilities in the global research ecosystem. 

Examples of Breaches and Their Consequences 

  1. Intellectual Property Theft: The theft of proprietary research and technology can cripple innovation in affected countries. For example, Chinese entities have been implicated in numerous cases of IP theft, leading to significant economic losses and stifling competitive advantages. 
  1. Unapproved Technology Transfer: Collaborative research without adequate security can result in sensitive technologies being transferred to hostile entities. This has implications for national security, as advanced technologies can be used to enhance military capabilities in adversarial nations. 
  1. Talent Drain: High-profile talent recruitment programs by the PRC have lured top researchers away from their home institutions, leading to a brain drain that undermines domestic research capabilities and innovation potential. 

Case Studies 

Understanding and Mitigating Risks 

Effectively mitigating risks is crucial for protecting intellectual property and maintaining research collaboration integrity. Institutions must comply with regulations from entities such as the Department of Defense (DOD), Department of Energy (DOE), and National Science Foundation (NSF) to secure and maintain funding. This requires thorough vetting of research partners and donors to avoid high-risk affiliations, ensuring transparency in all research activities and partnerships to meet regulatory requirements and prevent penalties, and safeguarding intellectual property while maintaining a research environment free from undue surveillance concerns. 

Leveraging Advanced Intelligence Tools 

Leveraging advanced data processing and risk analysis capabilities, institutions can identify high-risk collaborations and implement measures to safeguard their research, personnel, and funding. By ensuring compliance and protecting research activities, institutions can protect funding and maintain a competitive edge.  

Strider’s comprehensive data analysis and risk intelligence capabilities enable institutions to identify and mitigate these risks effectively. By providing visibility into potential threats and offering strategic insights, Strider helps safeguard research integrity and innovation. 

Conclusion  

The global effects of inadequate research security are profound and multifaceted. To protect funding, intellectual property, national security, and innovation potential, it is imperative to implement robust research security measures. Strider stands at the forefront of providing the tools and insights necessary to navigate these challenges. 

This is the third post of four in our Research Security blog series. To read the next post, click here.

This is the second post of four in our Research Security blog series. To read the first post, click here.

Introduction  

In the realm of international research, collaboration is often seen as a pathway to innovation and progress. However, not all collaborations are benign. The People’s Republic of China (PRC) and Russia have strategic motivations for encouraging open-source research collaborations that go beyond academic advancement. Understanding these motivations is crucial for safeguarding intellectual property, maintaining research integrity, and ensuring compliance with funding regulations. 

The PRC’s Strategy  

China’s ruling party takes direct control of the country’s universities, with presidents’ offices being merged with embedded party committees to form a ‘unified’ leadership for higher education. This centralized control is part of a broader strategy to advance national objectives through scientific and technological development. 

Xi Jinping, General Secretary of the Communist Party of China, has explicitly called for the PRC to achieve “high-level science and technology (S&T) self-reliance.” This directive is reflected in the party’s emphasis on “indigenous innovation,” which aims to reduce dependence on foreign technology and bolster China’s global competitiveness. 

Tactics Employed  

The PRC employs several tactics to exploit international collaborations: 

Case Study: University Involvement  

An example of this strategy is seen in China’s emphasis on brain research through the China Brain Project, which involves substantial government funding aimed at attracting global talent and expertise. International collaborations in such projects are closely monitored and leveraged to advance China’s strategic goals. 

Russia’s Approach  

Since 2022, the Russian government has poured significant resources, at least USD 110 million, into initiatives aimed at reverse engineering Western goods, particularly to copy Western weapon systems. Universities are integral to these efforts, offering training and conducting projects designed to replicate and improve upon Western technologies. At least two of the universities leading these projects have been involved in economic espionage activities, demonstrating the extent to which academic institutions are leveraged for state objectives (DNI.gov) (ProPublica). 

Implications for Global Research  

The strategic motivations behind the PRC and Russia’s calls for open-source research collaboration pose significant risks to international research institutes. These include: 

Ensuring Compliance and Protecting Funding  

For many academic institutions, the primary concern is compliance with regulations from bodies such as the Department of Defense (DOD), Department of Energy (DOE), and National Science Foundation (NSF) to secure and maintain funding. This involves: 

Mitigating Risks Through Advanced Intelligence 

Understanding and mitigating these risks is essential for protecting intellectual property and maintaining the integrity of research collaborations. Leveraging advanced data processing and risk analysis capabilities, institutions can identify high-risk collaborations and implement measures to safeguard their research and personnel. This approach helps secure funding while ensuring compliance with necessary regulations.  

The recent memorandum from the Office of Science and Technology Policy (OSTP) further underscores the importance of robust research security programs. It provides guidelines for federal research agencies to implement certification requirements for research security programs at covered institutions, aligning with National Security Presidential Memorandum-33 (NSPM-33) and the CHIPS and Science Act. These guidelines emphasize the need for cybersecurity, foreign travel security, research security training, and export control training. 

Specific Tools for Risk Mitigation 

Strider provides unique intelligence and tools necessary to identify and mitigate these risks. By leveraging our advanced data processing and risk analysis capabilities, research institutions can protect their intellectual property and maintain the integrity of their collaborations. Specifically: 

Conclusion  

While international collaboration is essential for scientific progress, it is crucial to remain vigilant about the hidden motivations of certain state actors. Understanding and addressing these risks ensure that research efforts contribute positively to global innovation and security. By staying informed and proactive, research institutions can continue to collaborate safely and advance their mission of expanding knowledge and creating a better world without compromising compliance or funding. 

This is the second post of four in our Research Security blog series. To read the next post, click here.

This is the first post of four in our Research Security blog series. To read the next post, click here.

Introduction

In today’s globalized research environment, securing funding and maintaining compliance with regulations are important for academic institutions. Research security has become a crucial issue that not only shapes national security but also directly impacts the ability of institutions to secure and keep funding. This blog will explore the importance of research security, why it is essential for compliance, and how it supports the broader goals of expanding knowledge and fostering innovation. 

What is Research Security?

Research security involves the protection of intellectual property, data, and sensitive research from theft, unauthorized access, and interference by foreign and domestic actors. It ensures that academic institutions can maintain compliance with regulatory requirements, secure funding, and foster safe international collaborations, among other benefits. 

Sethuraman Panchanathan, Director of the National Science Foundation (NSF), stated, “Research security is a critical matter. It is important that the research community, government agencies, and our international partners have frequent dialogue to share perspectives and help shape our research security policies and programs. Collaboration is critical to a vibrant science and engineering community, which includes domestic and international collaboration.”

Tightening Research Security Protocols

In recent years, the U.S. government has taken significant measures to enhance research security. One key development is National Security Presidential Memorandum-33 (NSPM-33), which directs federal agencies to strengthen requirements around disclosure of potential conflicts of interest and other forms of undue influence in federally funded research. This ensures transparency and accountability while fostering innovation and maintaining global partnerships in different communities of thought and study. 

Why are Research Security Protocols Tightening? 

Understanding real-world examples of research security breaches can help highlight the critical need for robust research security measures.

Case Study 1

One example involves an NSF-funded principal investigator who, unbeknownst to their U.S. organization, participated in a foreign talent program while holding a faculty position abroad. This case escalated when the investigator failed to disclose foreign affiliations and funding, which is required under NSF standards. The repercussions were severe: suspension of awards, resignation, and eventual government-wide debarment. This underscores the critical need for transparency from professors and the essential role that due-diligence tools will play in adherence to funding guidelines. Since the professor didn’t disclose those relationships and the research security team was blind to them, the university was punished via their reputation and the loss of essential funding.

Case Study 2

Another case saw a professor exploiting federal grants for research already conducted overseas. The breach involved not just the misallocation of funds but also an active effort to obstruct investigations by submitting falsified documentation. The subsequent criminal conviction of the professor highlights the rigorous measures taken to uphold research security.

Challenges from the PRC

The People’s Republic of China (PRC) has been the leading instigator of intellectual property theft and research security breaches in the West, employing strategic approaches to exploit overseas talent and acquire advanced technologies.

Xi Jinping, the General Secretary of the Communist Party of China, has called for the PRC to “achieve high-level science and technology (S&T) self-reliance,” resolve “key core technologies,” and reduce dependence on foreign technology. These tactics pose risks to international research institutes and corporations, including intellectual property theft and unapproved technology transfer.

Ensuring Compliance and Securing Funding 

While research security is crucial for national defense, it is equally important for compliance and ensuring the integrity of research activities. By adhering to research security protocols, institutions can secure funding, protect their reputation, and continue their mission of expanding knowledge and fostering innovation.

Strider helps academic institutions navigate these protocols by providing actionable intelligence that ensures transparency and compliance. Our tools help institutions identify and mitigate risks associated with foreign collaborations, thereby securing funding and maintaining research integrity. Two of the biggest impacts that our tools have are:

  1. Speed to Insight: Being able to more quickly process applications, give guidance to research security teams, and provide a holistic view of personnel’s relationships with foreign entities.
  2. Validating Information Provided by Self-Disclosures: Research security teams are required to verify the information submitted by professors in self-disclosures as they seek funding. That is a tall order, and most of the time, the team doesn’t have a starting point. People Search provides quick access to a list of publications, patents, funding records, and relationships to “malign talent programs”.

By leveraging Strider’s solutions, institutions can confidently secure funding and continue their research activities without compromising on compliance or security.

Conclusion

Research security is not just a matter of national security; it is essential for academic institutions to secure and maintain funding. By understanding and addressing risks, institutions can ensure compliance, protect their reputation, and foster safe international collaborations. Leveraging tools like Strider’s intelligence platform can help illuminate insights for institutions to navigate these challenges, and help ensure that research remains a catalyst for innovation and progress.

Lear more about Strider’s research security platform here.

Competing Governments and Global Economic Risks 

Today, many governments are using their international economic relationships to achieve their own strategic goals. Sometimes, this comes at the expense of their global partners. Countries like the PRC, Russia, and Iran often put this strategy to use to further their own technological interests, making it harder for businesses and academic institutions worldwide to protect themselves from these risks. 

That’s why Strider created Organizations Search, our third-party due diligence tool for security, compliance, and reputational insights. 

Huge Organizations Search Data Expansion 

This month, we’re excited to announce some major improvements to Organizations Search. These new milestones significantly contribute to our vision of Organizations Search being a comprehensive risk screening solution for strategic state-sponsored intervention in the global economy.  

Most notably, Organizations Search now includes government registration records for 200 million legal entities located in the United States, Canada, Europe, and Japan. Integration of this data into Organizations Search reflects the rapid maturation of Strider’s ability to illuminate risky economic connections around the world, not just within regions of special concern. 

In the coming year, we’ll be adding even more data sources related to cross-border trade, ownership, and other economic relationships. With these updates, our clients will gain an even deeper understanding of which organizations might pose a risk due to their economic connections. After all, state-sponsored actors don’t limit themselves to their home countries—they own, trade with, and collaborate with millions of organizations around the world. Our clients know this and are looking for scalable solutions to manage these risks. 

New Data from Russia and Iran 

We’re also excited to announce two new data additions specifically focused on Russia and Iran.  

First, we’ve added over 5 million supplier relationships from Russian government procurement records. This data shows which commercial firms in Russia have contracts with military, defense, and government end users. Understanding these connections can help our users identify companies with economic incentives to align with Russian government priorities. 

Second, we’ve added 2 million legal entities from Iran’s business registration system. This will help our users gain more insights into businesses operating in that often opaque region. 

Looking Ahead 

In today’s unpredictable globalized business environment, this type of comprehensive due diligence is more critical than ever before. 

These updates are just the beginning. We have many more exciting data expansions and features planned for Organizations Search in the coming months. These enhancements will further empower our users to screen broadly and deeply for state-sponsored risks within their global economic footprints.  

Learn more about Organizations Search here.

Request a demo to see what insights Organizations Search can unlock for your organization.

REQUEST A DEMO

In academia and innovation, the integrity and security of research not only propel the boundaries of knowledge but also safeguard the interests of national security. Strider, through its meticulous gathering of open-source data and strategic intelligence, stands at the forefront of ensuring that research institutes thrive in a complex landscape with security at the core of their efforts. 

Research Security as National Security 

The interconnectedness of global research initiatives has undeniably spurred innovation at an unprecedented scale. However, this openness has also introduced vulnerabilities that foreign entities, governments, or individuals exploit, casting a shadow over the integrity of research endeavors. The U.S. government’s growing apprehension towards such influences underscores a crucial equilibrium—one where research security and international collaboration must coexist without compromising the other. 

Instances of these concerns range widely, from the inadvertent sharing of proprietary information and intellectual property to the non-disclosure of substantial foreign support. These are not mere administrative oversights but potential breaches of national security. Thus, ensuring research integrity is more critical now than ever, demanding a vigilant and proactive stance against such influences. 

Many Faces of Research Security Breaches

The National Science Foundation (NSF) regularly provides examples of the various types of research security breaches to highlight the myriad ways they occur and bolster efforts to identify and mitigate these threats. Below are two case studies NSF recently shared: 

Case Study 1 

A striking example involves an NSF-funded principal investigator who, unbeknownst to their U.S. organization, participated in a foreign talent program while holding a faculty position abroad. This case escalated when the investigator failed to disclose foreign affiliations and funding, a requirement by NSF’s standards. The repercussions were severe—suspension of awards, resignation, and eventual government-wide debarment. This case underscores the critical need for transparency and adherence to funding guidelines. 

Case Study 2 

Another case saw a professor exploiting federal grants for research already conducted overseas. The breach involved not just the misallocation of funds but also an active effort to obstruct investigations by submitting falsified documentation. The subsequent criminal conviction of the professor highlights the rigorous measures taken to uphold research integrity and security. 

Using Data to Protect Data 

At Strider, our approach to safeguarding research and fostering secure international collaborations is rooted in strategic intelligence. This intelligence is sourced from a comprehensive collection of critical open-source data, which is then augmented by proprietary data processing methodologies. Our suite of products and services is tailored to preemptively identify and mitigate risks, ensuring the integrity of your research endeavors. 

Insights

Insights stands as our flagship offering, empowering organizations to discern and protect against pursuits by foreign governments. It identifies which of your technologies and research topics are at risk of being targeted by foreign governments. It also illuminates any connections to sanctioned, restricted, or state-owned entities your employees—including researchers—may have. With Insights, you can ensure individuals working on specific research have disclosed appropriate information and connections beforehand.   

People Search 

People Search facilitates instantaneous due diligence, screening for potential state-sponsored risks among researchers and visitors. Its sophisticated identification process illuminates connections that might pose security risks in areas including restricted government and military entities, as well as industry and education associations. 

Organizations Search 

Organizations Search enables third-party due diligence for security risks before collaboration and partnership. It reveals connections that third-party partners may have with restricted or high-risk entities, including foreign government, defense, research, or military institutions. 

Shield 

Shield is an email security tool that offers protection against covert attempts by state-sponsored actors to solicit your researchers and employees. By providing an ever-growing list of verified email addresses, domain names, and key words directly linked to such actors, you can be alerted when anyone in your organization is approached. 

Conclusion  

In an era when the geopolitics of research security are continually evolving, Strider helps research institutes be better equipped to safely navigate state-sponsored risk with critical strategic intelligence. Reach out to a Strider representative today to see how you can better enhance security in your organization. 

Strider is pleased to introduce Services, a new set of offerings to help private-sector organizations develop advanced economic security programs to better manage state-sponsored risks. 

Through customized, hands-on training, Services empowers security professionals to enhance their existing economic security program, utilize high-impact data and research, and increase competitiveness in a rapidly changing global risk landscape. 

Services is led by Strider expert Gunnar Newquist, who has 30 years of experience as a special agent at the US Naval Criminal Investigative Services, along with 10 years of experience working with major corporations on corporate security issues, including Deloitte and Boeing. 

Services is separated into three offerings designed to meet your organization’s current needs. Each offering can be purchased separately or can be purchased as a comprehensive package. 

Environment 

To secure your organization effectively, you need to comprehend both external and internal environments. Externally, you need to understand what foreign governments are seeking and how they get what they want. What technologies are they after? What steps do they take to get what they are after? Internally, you must understand who (i.e., employees, collaborators, or visitors) and what (i.e., specific technology, critical infrastructure, or data) are likely to be targeted.  

Services helps you to understand these two areas intimately so that you can allocate your resources strategically and be prepared to protect what matters effectively.  

Strategy  

With so many potential risks and threats in unique circumstances constantly requiring your attention, it can be easy to slip into reactive, ad-hoc security responses. Services partners with you to develop a proactive security response that works for you and your organization. It includes developing robust threat assessments, risk prevention strategies, and clear investigative plans.  

Protect proactively and clearly by having a comprehensive strategy written and processed before risks turn into threats.  

Education 

Educating your people, stakeholders, and executives in a thoughtful way not only builds trust within your organization, it also empowers employees to make wise decisions to avoid getting entangled in relationships that could hurt them and the company. 

Services provides a paradigm to educate your organization of the most pertinent information based on your audience concerning state-sponsored risk. It includes developing training materials for targeted work unit, executives, and all employees at large.  

Request a demo for Services today and see how you can better harness the full power of open-source intelligence and safeguard against state-sponsored risk.  

By Gunnar Newquist, Client Advisor at Strider 

In my years in the security industry working with both government counterintelligence programs and corporate insider threat programs, I’ve seen many programs at varying degrees of maturity. Some had experienced practitioners, a well-defined working group of stakeholders, and program members knew their responsibilities and understood the actual risk environment. Other programs had loose procedures and followed processes on a case-by-case basis. Many of the less experienced programs were driven by enthusiasm but lacked a clear threat picture. Over the years, I’ve observed three critical differences between mature programs and less mature programs: 

  1. Mature programs understand that data without context leads to more danger 
  1. Mature programs have clearly defined processes  
  1. Mature programs focus on educating their at-risk employees 

Mature programs understand that data without context leads to more danger

“False positives” is a term all too familiar to insider teams.  User and Event Behavior Analysis (UEBA) tools are effective at generating indicators of abnormal behaviors, which are indicative of insider risk. However, the UEBA tools use of risk indicators are only as effective as the actual data feed. When the UEBA data is reviewed, there is a temptation to feel the information is conclusive, when in fact the data is often limited to simple binary indicators which need to be further examined or investigated.  

For example, a certain employee has a high-risk score in a UEBA platform because they have worked unusual hours, exfiltrated a large volume of unidentified material, and expressed hostile sentiment. These combined observed behaviors are an indicator of potential risk but may not provide conclusive evidence of a policy violation or IP theft. Understanding why the employee violated policy provides valuable context. Knowing if this information has been targeted by state-sponsored actors and if the employee has any indicators of an ongoing relationship with state sponsored actors provides much needed context to understanding the actual intent and associated motivation.  

All too often when conducting a reactive investigation, investigators are looking for evidence which simply demonstrates the policy violation, and in their rush to protect the data, do not take the time to understand the employee’s motivations and intent. In some cases, the investigators do not understand or appreciate the relevance of the state-sponsor nexus. Therefore, their investigation is deemed successful as it discovered a policy violation, but the opportunity to uncover deeper damage is missed.    

Mature programs have clearly defined processes

Economic Security programs should not be run like a police homicide unit, only initiating investigations in response to discovering a dead body. Mature programs work to protect their employees at greatest risk and prioritize their focus on the technology of greatest interest to state-sponsored actors. Mature programs understand which company data needs to be protected and have repeatable and defensible processes for prioritizing their investigations.    

Repeatable: Mature programs have developed standard processes to use when triaging surfaced risk. These standardized processes prevent mistaken omissions, allow for better understanding of the threat environment, and prioritize their limited resources to focus on the incidents which could cause the greatest damage to the company. Creating an investigative response matrix to standardize investigative response utilizing such factors as “value of information at risk,” “state-sponsored interest,” “employee’s nexus to state-sponsored actors,” “violation of policy,” and “past risky behavior” creates a repeatable process which allows for more comprehensive understanding of your risk vectors.  

Defensible: Mature programs recognize that any employment action in response to the results of an investigation can result in legal action. Therefore, clear policies should be established. Having a standard investigative response process focused on identifying policy violations and gathering tangible evidence can help avoid these lawsuits and help defend the company’s actions when they inevitably occur.   

Proactive: Mature programs understand their risk environments and therefore are proactive in their efforts to prevent state-sponsored actors from stealing their intellectual property (IP). Developing a deep understanding of who the state-sponsored actors are, what they are interested in, and how they initiate relationships with targeted employees with whom they can later exploit, allows mature programs to identify this behavior in the initial stages to proactively confront their efforts and better protect their IP.     

Without established processes, mistakes are made that can end in uneven results, missed opportunities, or the appearance of unethical behavior. 

Mature programs focus on educating their at-risk employees

Mature programs understand the value of educating at-risk employees regarding the methods in which they may be approached by state-sponsored actors. Educating your people, stakeholders, and executives in a thoughtful way empowers them to make wise decisions and avoid getting entangled in relationships which could hurt them and the company. Once you understand your threat landscape, it can be shared with those at risk so they too understand it and can take defensive action. 

Providing customized briefings that clearly demonstrate what technology is being targeted and by whom resonates with the employees directly working on the technology in question. These briefings instill trust between the affected employees and the security program, resulting in a greater exchange of information. 

Informing all employees about the risks of workplace violence is important. However, security programs aimed at countering state-sponsored risk should prioritize the protection of critical technology assets and the evaluation of relationships between employees and state-sponsored entities. Mature economic security programs build customized training material for the employees directly associated with the technologies targeted by state-sponsored actors. Security teams share:  

The training material is designed and delivered in a way which instills trust and encourages employees to notify security when they suspect they have been approached. 

Conclusion
Maturing programs may not always recognize the value in gathering relevant information to get a complete understanding of intent behind the theft of IP, they may be reluctant to formalize a repeatable, defensible, and proactive strategy and they may still use generic training material when educating their employees.   

Developing an effective security program is a complex endeavor that requires time, experience, financial resources, stakeholder support, and strong leadership. Nevertheless, well-designed programs necessitate and benefit from strategic planning. Established programs place value not only on data but also on grasping the underlying motives for behavior, taking proactive measures, maintaining repeatable and defensible procedures, and fostering a culture of trust in the workplace by transparently sharing their understanding of risk with the most susceptible employees.