A mid-sized mechanical engineering company discovers that its latest product appears in a slightly modified form at a foreign competitor just weeks before its own market launch. The design data is nearly identical. Two years of development costs and several million euros have been devalued — the head start is gone.
Espionage aims to gather, analyse and exploit information about companies, people or products. The BSI lists this threat as G 0.14. The methods range from highly complex technical attacks to simple shoulder surfing at an ATM.
What’s behind it?
Espionage is any systematic attempt to obtain confidential information. The motivation may be economic espionage (state-directed), industrial espionage (private sector) or personal enrichment. The processed information gives the attacker competitive advantage, enables blackmail or serves to replicate protected products.
Attack methods
- Technical attacks — trojans, keyloggers, network sniffing, man-in-the-middle attacks. Malware is often delivered via spear-phishing emails tailored to specific people in the company.
- Social engineering — attackers pose as suppliers, IT support or job applicants to gain access to premises or information. Particularly effective in combination with previously gathered OSINT.
- Visual observation — reading along at the screen (shoulder surfing), photographing documents, observing PIN entry. Simple but effective — especially in public spaces.
- Acoustic eavesdropping — listening in on conversations in offices, meeting rooms or public transport. Open-plan office concepts favour this attack form.
- OSINT aggregation — individually innocuous public information (job advertisements, social media posts, company register entries) is combined so that it reveals confidential connections.
Impact
The damage from espionage primarily affects confidentiality but can have significant financial and strategic consequences: loss of competitive advantage, devaluation of research investments, reputational damage and — for personal data — regulatory consequences. Espionage attacks often remain undetected for months or years because the attackers take care to cover their tracks.
Practical examples
Spear phishing against the research department. An attacker analyses the LinkedIn profiles of engineers at a technology company and identifies an ongoing research project. They send a convincingly genuine email referencing a real industry conference, with a crafted PDF attached. The keylogger that installs itself records access credentials and confidential correspondence for weeks.
Conversation recording in the meeting room. An external service provider who regularly performs maintenance work in the building places a miniaturised recording device in an executive meeting room. Strategic decisions, acquisition planning and financial data are recorded over weeks and forwarded to a competitor.
OSINT aggregation from public sources. A competitor systematically evaluates a company’s job postings, patent applications and conference contributions. From the combination of these sources they reconstruct the technology roadmap, the planned market entry strategies and even internal organisational structures — without ever compromising a system.
Relevant controls
The following ISO 27001 controls mitigate this threat. (You’ll find the complete list of 47 mapped controls below in the section “ISO 27001 Controls Covering This Threat”.)
Prevention:
- A.5.14 — Information transfer: Rules for the secure transfer of information across all channels.
- A.6.3 — Information security awareness, education and training: Sensitisation to social engineering attacks and everyday information protection.
- A.7.6 — Working in secure areas: Access rules and behavioural guidelines for sensitive areas.
- A.8.3 — Information access restriction: The need-to-know principle limits the circle of people with access to confidential data.
- A.8.12 — Data leakage prevention: Technical measures (DLP) detect and prevent the uncontrolled outflow of confidential data.
Detection:
- A.8.15 — Logging: Recording accesses to confidential information enables retrospective analysis.
- A.8.16 — Monitoring activities: Active monitoring detects unusual access patterns and data outflows.
Response:
- A.5.24 — Information security incident management planning and preparation: Documented response plans for suspected espionage.
- A.5.25 — Assessment and decision on information security events: Structured triage for indicators of information outflow.
BSI IT-Grundschutz
The BSI IT-Grundschutz catalogue links G 0.14 to a large number of modules, including:
- DER.2.3 (Remediation of far-reaching security incidents) — requirements for the processing of serious incidents, which espionage regularly is.
- ORP.1 (Organisation) — organisational foundations: roles, responsibilities and information classification.
- INF.7 (Office workplace) — security requirements for office spaces that impede visual and acoustic observation.
- CON.7 (Information security while travelling) — protection measures for mobile work and business trips.
Sources
- BSI IT-Grundschutz: Elementary Threats, G 0.14 — original description of the elementary threat
- BSI: Economic Protection — information on protection against economic espionage
- ISO/IEC 27002:2022 Section 8.12 — implementation guidance on data leakage prevention