Schneier on Security

Clive Robinson • January 5, 2013 10:46 PM

@ withheld.for.obvious.reasons,

I used to work for a company that was involved with citation databases for academic medical and industrial organisations.

As you will appreciate knowing what an organisation has searched for gives an increadably strong indicator as to what they will be researching next, and the refinment of the searches as they study the papers the initial search brought up just about nails it cold.

Most people who have had to use patent search engines are also aware of this as well.

The usual way to deal with this is by noise and diversity. That is make lots of searches in a way that hides the real search and use as many unrelated search engines as possible so that no one organisation sees the whole search and what they do see is hidden in noise.

Unfortunatly modern algorithms will strip the signal from the noise and in most cases there are not enough database search organisations to use diversity.

But worse for you you are looking at online purchases so you cannot generate noise as this would involve considerable expense and secondly you remove another diversity aspect by actually making a traceable purchase and delivery.

As to your questions the second one is perhaps the easiest to answer,

With the economic conditions as they are doesn’t this put us at a competitive disadvantage with respect to others

Potentialy yes, but only if they are looking for you or you chose for whatever reason to stand out in some way.

That is as an organisation prior to your first product going to market you were just one of thousands of such organisations setup each year.

And unless you chose to be visable there was nothing very much that indicated your organisation existed let alone indicated that it might be of comercial interest.

However there are unfortunatly reasons why you might chose to be visable and make noise and indicate your organisations presence by contacting journalists or other news organisations. One such is raising investment from venture capatalists or less preditory external investors. Another is to recruit the right people.

So the real issue is recognising what lifts your organisation above the general noise floor, or trips a filter to make your organisation “known” and working out how to best mitigate the downside that occurs from such activities.

There is of course a downside to this, firstly the mitigation process can be costly, it slows development and perhaps worse may atract the wrong sort of attention. This is because some of this covert mitigating behavior is very like that of criminal organisations involved in producing illegal items such as counterfeit goods and banned substances…

It also makes it difficult to raise external funding because the mitigation strategy looks like exactly what it is “a process to hide something” only it’s likely that any potential investor is going to assume what you are hiding is some kind of fraud, not protect IP.

One way to mitigate such issues is the way the film industry and some other industries work which is to have seperate companies for each project. That is the main persistent companies for holding and investment / leasing, and a new company for each project. Depending on your juresdiction there may even be tax advantages to doing this as well. Further it also makes “spining off” projects to other organisations considerably easier as clear dividing lines exist from day one.However since the likes of Enron this multiple company aproach can raise other red flags.

Which comes back to your first question,

How do we remain competitive with the high level of activity we must employ as a small business to maintain a suitable assurance of integrity and propriety

One traditionaly touted way is to remain “fleet of foot” that is get a product from initial conception to market before the larger and slower organisations can.

However for those that have tried this method it’s very high stress and realy does not provide a comensurate competative edge these days for the majority of products.

It also only realy works for a small organisation of just a handfull of people that integrate well as a team and have common goals. That is small organisations where each member of the team is also a major shareholder and thus has a substantial interest in making the organisation work, which is a working definiton of many start up companies.

I’m guessing you’ve gone beyond the start up stage and have regular non shareholding employees at all levels of the company, and in particular some senior positions.

One way to make an organisation less visable is to exploit some of the advantages of virtual companies.

Many virtual companies have a very tiny if non existant geographical footprint, and as such a low overhead. Basicly they are comprised of out of office workers who work from home, or on the road or in coffee shops etc. They look like a single organisation simply because they share an identity which is enabled by technology, so have a common phone number, snail mail address, email address, corparate credit cards etc.

What you want to do is have employees that work at home from their own non organisational phone, internet connection, EMail, credit card etc. That way when they do online searches and purchases from home using their personal identities not their organisational identities, there is no direct tie back to the organisation visable from the sites they have searched and have purchased from. There are obviously some difficulties involved but the use of pre-payed credit cards etc can do much to eliviate these issues.

One thing I have seen used in the past is to rent computer space in various co-location providers and VoIP connectivity from various providers it was used by organisations to appear to have many branch offices etc with local dial numbers. The organisation concerned was for servicing domestic appliances for an insurance company and the service personnel hand “company vans” although they were in effect self employed.

I even helped a small manufacturing organisation use a similar system to give them “world wide” offices with local freephone numbers going into a VoIP back end back to their sales force in their home country (a bit like “Indian Call Centers” but in reverse).

Surprisingly you can rent shared computer space where you can log in and then use it as a relay for your internet searches for just a few USD a month in effect you set up your own private network that has some of the advantages of a TOR network.

And within reason you can use a variety of comercial or non comercial anonymous networks for doing searches.

There are also quite a few comercial organisations that provide “meeting places” and other “office services” for people running small companies that will do “signed for deliveries” and mail forwarding for you, whilst these sevices are somewhat more expensive they are not exorbitant.

The important thing to remember is what ever you decide to do you must take the required steps to show that it’s not being used for fraud should any official come knocking. That is you need to keep good and honest records of all activites and carry out active auditing etc to stop staff etc misusing the system.