One manager i work with insist companies take the time to spy on large competing companies. The company itself does not allow passwords to be revealed by phone or IM with our jabber IM being encrypted (or so i am told) and running on company servers/machines.
Is there any truth to it or is he (and some people in the company) being paranoid?
Yes and no. There have certainly been cases of people snooping into the business of other people. There's been cases of people getting access to corporate secrets by sheer dint of social engineering.
If everyone within the company knows that you only ever reveal passwords by encrypted email to within the company or by handing over an envelope with the password inside, anyone who tries to social-engineer access from you suddenly has a bigger problem.
They can't just phone up and go "It's Bertie. YOu know I'm off on holiday" (this information handily provided by the corporate policy on having an accurate out-of-office message) "and I wanted to do some quick checks on the doodah, but it seems my remote access password has expired. Could you reset it and tell me the new one?"
Mostly because they'd then have to say "Sorry, Bertie, you know you have to pick that password up from our nearest office, identifying yourself with the corporate ID badge".
Same thing goes for IM. Can you tell from the chat window exactly where the oter end of an IM conversation is and who's physically present at that end? If you can't, revealing something sensitive runs the risk (remote as it is) that whoever you're talking to isn't who you think.
Of course, there's always the need to balance convenience and security. It may be that revealing passwords over phones and IM sessions is convenient enough (and frequent enough) that it outweighs the security implications. I cannot tell you if that is the case for you.
Whether this manager is right or not, there is a lot to be said for finding a good balance between behaving as if he is correct, but without stopping the progress of the business.
I hate the term "paranoid" to describe secure business practices, by the way. Unless the precautions are truly over the top vs. the risk being addressed there is nothing "paranoid" about treating company and customer information carefully.
Keep in mind that someone might not only be trying to 'steal' business secrets in the sense of future secret projects, but also things like internal price lists and customer details (useful to a competitor who would like to undercut you).
Also consider criminals who might quite like to steal the list of customer details including credit card numbers from that poorly protected, unencrypted CRM database that everyone knows ought to be updated but no one ever gets around to doing. This latter example has certainly happened often enough to be a real concern.
The precautions you outline in your question are certainly not any evidence of security "paranoia" as far as I'm concerned. I'd say those are part of the absolute minimum standards that any business that was serious about protecting its own interests and liabilities plus those of its customers ought to be doing as a matter of course.
I'm not sure how a password could be revealed by phone. It would never be stored in cleartext anywhere, and no one should know someone else's password.
However, there are companies that specialize in corporate intelligence that you can hire to watch other companies. Not necessarily so nefarious that they try to hack the competition, but, enough intelligence to learn about new products, current products, etc. There are of course black-hat people in companies that will go a step further and probe their competition for security vulnerabilities, etc.
In this day and age of agile development, it takes months rather than years to imitate the competition and write software that is passable enough to gain clients or at least present the product for sale. In other IT businesses, competitive edges are very hard to maintain.
Look at the lengths Apple and other companies go through to keep new releases from the public until they are ready.
Loose lips sink ships.
Realistically, it's always easier to just hire away the humans that engage in what you might assume to be spying (intercepting packets as you describe, etc). I'd be curious to know what sector you're operating in, as that might make a difference in who your perceived adversary is.
An example: A trader from Goldman Sachs left the firm to join a competitor in the high-frequency trading space. He is alleged to have stolen source code from his previous firm.
[O]n Friday, one Sergey Aleynikov was arrested at Newark airport by FBI agents, as he was coming back from a trip to Chicago (maybe visiting his new employer), on what are basically industrial espionage charges.
[...]
In the 5 days immediately preceeding his departure from "Financial Institution" (potentially GS), Sergey allegedly downloaded 32 megs of ultra top-secret quant trading proprietary code, that, according to Special Agent McSwain's affidavit, he then proceeded to encrypt and upload to a website in Germany, with a UK owner
Another classic example is government-industrial espionage, of which the French, Chinese, and others have been accused (and of course they have accused the United States similarly). From a case study on the French:
[This report] examines the industrial espionage activities of a French electrical engineer against an American software engineering company in Northern California. It illustrates the relationships between French government and business intelligence activities and the way in which even the smallest American firms are at risk from sophisticated and focused intelligence tasking and operational activities.
[...]
deGaulle initially authorized the aggressive collection of economic and technological intelligence information in order to assist French companies and industries become more competitive in the international marketplace.
The old fashioned dumpster diving is still in vogue and can still provide useful information if an organization doesn't pulverize all paper leaving their offices.
Tail-gating at a secured entrance is common practice even though many companies publish policy statements against it.
Smoke-holes still exist and just because that guy hanging around the company smoke-hole is wearing a Cisco shirt it doesn't mean that he is a legitimate vendor taking a smoke break.
