2024 State of Vishing Report

Protecting Trade Secrets from Physical Intruders

Share This Post

Companies that hold trade secrets, intellectual property, or proprietary research are under attack. The attack is multifaceted and includes both cyber and physical intrusion.  As mentioned in the March 2018 Social-Engineer.org Newsletter, cyberespionage has “changed from isolated and individualized attacks to attacks run by distinct groups resembling traditional Mafia organizations.” Additionally, protecting trade secrets from physical intruders must be a priority. Companies are at risk from social engineering attacks that include physical intrusion. Tailgating is one of the most common methods used by intruders to gain unauthorized entry. An intruder may also pose as a contractor, business contact, delivery person, or employee to gain access to restricted areas where confidential information is kept. 

To protect trade secrets from physical intruders, a security strategy that includes both the technical and human side is essential. Simply being observant to strangers or unfamiliar faces in the workplace can improve security. This is well illustrated by what happened at Medrobotics, a company that manufactures and markets robotic surgical products. Due to the nature of their work, protecting trade secrets and intellectual property is a core company value.  Protecting Trade Secrets from Physical Intruders

CEO Catches Unauthorized Intruder

It’s 7:30 pm on August 28, 2017. The CEO of Medrobotics, Dr. Samuel Straface, is the last to leave the office for the day. On his way out, he notices a man in a conference room, inside the company’s secured space, with three open laptops. Dr. Straface does not recognize this man. He knows he is neither a contractor nor a business contact, he also knows there are no meetings scheduled at this time.  

Samuel Straface has a personal policy; if he doesn’t recognize you, then you have earned an introduction. This leadership style serves two purposes. First, it enhances a feeling of “team.” Each person who works for his company is important to him. Second, it enhances security. An unfamiliar face cannot unobtrusively slip in. Dr. Straface does not ignore the man in the conference room. Instead, he introduces himself as the CEO.  His conversation with the unknown man raises “red flags.” He calls the police. The police, in turn, call the FBI. The intruder is arrested on suspected corporate espionage charges.  

How Did the Intruder Gain Access?

August 28, 2017, marked a significant company milestone for Medrobotics. Earlier in the day, the company’s Flex robot-assisted surgery system had been used in the world’s first scar-free robotic colon resection at George Washington University Hospital. To acknowledge this achievement permission was given to celebrate at a nearby pub.  Executives, engineers, and staff rush the front door as they leave to celebrate. It’s believed that during this exciting rush the intruder, Dong Liu, slipped in. Despite Medrobotic’s policy requiring visitors to sign in, the visitor log for that day contains no record of Liu. Did he choose this time to access the building by pure coincidence? It’s still uncertain. However, in the FBI investigation, it was discovered that Liu had been contacting Medrobotic employees through LinkedIn. 

Protecting Trade Secrets – Lessons Learned

The experience of Medrobotics and the CEO, Dr. Straface, illustrates the value of a multifaceted approach to security. It’s important to combine the “human side” together with the technological side. Two takeaways to consider: 

  1. The CEO’s personal policy was a defensive strategy. Being alert to strangers enhances security. Therefore, implement a similar policy. By doing so you reduce the risk of strangers slipping in.  
  2. A lapse of security may have occurred while the staff rushed to leave the building to celebrate a company milestone. So, have a security plan ready for special occasions that create a diversion from what is normal or typical. 

In this age of economic and corporate espionage, protecting trade secrets, intellectual property, or proprietary research should be a core company value. Don’t wait until it’s too late.  Security training that includes physical intrusion as part of penetration testing is a necessity.  


You May Also Like

Social Engineering News: Impersonation Attacks

More To Explore

Learning from the MGM Security Breach
Protect Yourself

Learning from the MGM Security Breach 

In the rapidly evolving digital landscape, no entity is immune to the pervasive threat of cyberattacks. The security breach at MGM Resorts highlights the vulnerability of even massive organizations. As

Smishing attacks in the news

SMiShing Attacks in the News 

SMiShing Attacks in the News In February 2024, 19.2 billion spam texts bombarded U.S citizens according to a recent report. As annoying as spam texts are, they are not always