Finders Keepers

Corporations lose data in a variety of ways, with impacts to the organization and to the privacy of individuals.

The view from the advantage of the threat actors becomes a bit clearer when the lost data is identified simply as contraband. Once the information has sloughed off the bonds of the corporation, it has no legitimate purpose*. Analogies to the illicit drug trade are both illustrative and fun.

Misplacing Your Assets
The Pawn Shop Lost Laptop with Millions of SSNs = Second Hand Escalade with G Pack of Yellow Tops in Door Panels
In this instance, the possessor of the item is not aware of its contraband contents. If he does discover the contraband, and he is a good citizen, he destroys it. No one would believe the innocent way he came to possess the contraband, and since he is not in the game, there is no easy way to convert it to cash. The contraband is useless, and the prior owner (Escalade gangster / VA administration) need not be concerned with dilution or market / rampant identity theft. Is there a countermeasure for absent-mindedness?

Theft
Hijacked Ground Stash = 0day Exploit on Corporate Server
The skilled threat actor knows where the contraband is, steals it, and converts it to cash. Outmoded models of the hacker as the intellectual curious, yet socially maladjusted prankster are fading even from CISSP training manuals. See Krebs and Omar Little for examples. What's the countermeasure? Awareness and solid operational security.

Insider Fraud
Shorting the Count = Podslurping**
With means and opportunity, the insider can palm a few bills, snake a couple vials or pop a portable hard drive into a workstation. The countermeasure is the same: a well enforced security policy. "The count is right" is a street version of a completed GLB questionnaire. Corporations have some advantage over the corner, since the insider motive is dependent on the ability to turn the contraband into cash.




*Focussed on NPI and trade secrets. Could be that digital entertainment could serve a social purpose, but that would require more twists in my already contorted argument.
** I hate this unfashionable term so much, I am compelled to use it.