I have the thankless job of protecting company secrets from breaches. My efforts are increasingly the spotlight with every new article on the TJX breach. How can large companies, like mine, know where their intellectual property is and how to protect it when it changes daily?

Another day, another headline in the mainstream media about a big company losing control of their data. Recent word from TJX shows that their costs for breach cleanup may exceed $250 million. This of course gets the attention of your executive suite who wants to know what YOU are doing to prevent this from happening at your company. I am happy to say there is plenty you can be doing. The technology has finally caught up with our security needs in watching and protecting our intellectual property (IP).

Three Step Process

There are three major steps in finding and protecting the crown jewels of your company. Each of these is a project in its own right and will take time and energy. These projects however, provide a flexible security program that meets the needs of your business and follows the data in it travels. The system works as I have both seen it implemented successfully at all size firms and deployed the same solutions myself. In short the three steps are:

* Get to Know Your Business

* Scan for IP

* Create Controls and Protections

Knowing your Business

This is the cornerstone to any successful IP protection architecture and thus your security career. You must learn to speak the language of business, specifically your business. Become the wise counselor to the heads of your various business units. Knowing your business processes tell you three important pieces of information about your IP. It helps you to:

* Learn where your IP lives

* Learn which IP is most important

* Learn how it moves from point-to-point

Scan for IP

Once you know the business units have helped to decide what IP they own and its relative value you need a process to scan for it. Most of your IP will be internal so let's begin with that process.

Internal scan

There are several technologies that can automate the process of an IP scan. Some you may already have in place and never thought of using from a security perspective. Using a content monitoring solution is a natural place to begin as it is cost-effective, can scan IP as it transits to/from the Internet and may also scan your network repositories and desktops. It is a versatile solution. You may already have a database monitoring solution in place for compliance. Consider leveraging this tool to look for your most important IP. Use an enterprise forensic/ eDiscovery software tool if you have it deployed. Why wait for an investigation to use this rather expensive tool. This tool is ideally suited for manual scans of IP and its location. Be prepared for some surprises here... Not everyone follows your data classification policy.