CSO

When most people think of losses resulting from poor security practices, they generally think of damages relating to unauthorized access of their systems.  However, there is another, potentially far more significant, type of damage that may result from inadequate security:  poor security practices can result in a loss of trade secret protection for a business’ most valuable information.
 
In one case, a business sued a competitor for unauthorized use of its customer lists, vendor lists, pricing information, software, and marketing plans – all of which the business claimed were its trade secrets.  The business lost the litigation because it failed to establish that it had used reasonable efforts to protect the secrecy of its proprietary information. 
The business had failed to require its customers to sign software licensing agreements or confidentiality agreements and allowed customers to transfer software freely from one computer to another.   Technicians failed to change default passwords in the software.  Additionally, a bug in the software allowed customers to gain access to the software without using a password and the business did not act swiftly to correct the bug.  Finally, the business had failed to enter into appropriate agreements with its employees to protect the confidentiality of its trade secrets.
The lessons learned from cases such as the foregoing are those that any good security policy should address:
1.  Have each employee sign an appropriate agreement addressing confidentiality, intellectual property ownership, and non-competition.
2.  Institute procedures within the organization to educate employees about trade secrets and inform them of their obligations to protect such information.  These procedures should include specific instruction to employees regarding their obligation not to use trade secrets after they leave the company.
3.  Require customers to sign license and/or non-disclosure agreements to limit their use of proprietary information. 
4.  Adopt procedures to require employees to change default passwords and to promptly remedy security bugs in software.  Carefully document efforts to resolve security bugs.  If necessary, this documentation can be used to help establish that the business acted reasonably in addressing security flaws in its products.
5.  Do not post trade secret information in publicly accessible places like the Internet, unless every visitor is required to agree to terms and conditions regarding their use.  The classic example of this problem is when businesses post product user guides on the Internet.  These guides can, and frequently do, contain valuable trade secrets.  Unless access to the guides is subject to the acceptance of an on-line license or non-disclosure agreement, trade secret protection may be lost.