Take-away from "Securing Intellectual Property" by syngress

Unprotected Intellectual Property(IP) is worthless IP.  An IP protection program is a must for every company.  To have a successful protection program all IP must be identified and the associated risk for each idea evaluated.  The Plan has to be built around the company, and the plan has to be implemented like any other project.  Throughout the implementation, the plan will have to be tailored to fit seamlessly with the successful business that is paying for its implementation.  Finally, the executors of the plan need to understand the plan and agree with the implementation.  With special attention paid to those factors an IP strategist sets themselves up for successful protection strategy and a happy client.

Identification is what IP strategists are trained to do from their first day in law school: identify what statutory category, if any, the idea belongs to.  Classifying the associated risk is only a little bit harder than identifying the idea.  The risk of a losing intellectual property to theft or accidental disclosure is a product of: the probability of losing the IP; the vulnerability of the idea; and the impact it would have on your business, if lost.  The probability is a number that you will have to come up with based on how unscrupulous your competition is and how closely you feel you are being watched.  Vulnerability is the adaptability of the IP.  If it's a trademark or patent then you own the rights and disclosing it shouldn't hurt you; it's vulnerability is low. if it's a list of client leads then the vulnerability is high.  The impact is a matter of dollars and cents, how much will it hurt to lose the idea to a competitor or the public.

Building the protection plan is as much a matter of accessing the vectors of threat for your IP portfolio as it is making a plan that works well and intuitive for the people who have to use it.  Books are written on how information should be secured and what vectors supply the most real threat to your IP portfolio, but it is safe to say that a security audit needs to be done and then recommendations should be made based on the results of that audit.  Once you have an idea of your weaknesses the remedies for those weaknesses will be many, and this is the all important part where the security team sorts through the possibilities and sees which ones will be the easiest and most successful to implement.  They make their decision based on the associated risk of each weakness and the cost of implementing the remedy; both monetary costs and human costs.  The most important thing is that the idea-having people not get constrained and the business not have it's profitability capped because of security measures.  Because there won't be anything to secure, if your security measures run the business into the ground.

During the implementation process, some processes will meet with resistance and some milestones will not be met.  At these times, it is important to take stock of the fact that you are there to help the people of the business do their job better.  This means that if something is not working, it's better to look at it from the view point of what you are doing wrong, because blaming the client for not being able to follow your processes is a dead end road;  It's also not what they are paying you for.

The last step is not chronologically the last step but it is the last thing you need to check off before you leave the client: the executors of the protection plan need to understand the plan and stand behind it.  Policies that are understood will be wrongly implemented or disregarded for convenience.  It's important to make sure they fully grasp how the plan works, and what it's purpose is.  Making sure they stand behind it will come secondarily if the executors of the plan understand the plan and see it's value.