I found the original question to be a bit confusing too when it was asked of me. There is an element of this that is hygiene. Of course we we would encrypt at rest, follow least privilege, etc. Anything that we would do for any file share on our networks. But on quizzing some of my counterparts in the industry, I found a very wide swath of practical steps taken. FIPS Secured drives. DOD level encryption. Onsite file stores, inaccessible externally. One person told me that they were looking at quantum resistant encryption schemes. And others just used basic encryption / hygiene. The variance confused me because when I asked, the answer was simply that the FDA had to review the ads before release so they wanted to take proactive steps. Admirable. But why the variance? I read through the FDA regulation on it, and predictably, it is descriptive, but not proscriptive (as any government regulation is). So why is basic hygiene good enough for some pharma companies, and others act like they're holding the nuclear codes?
The most relevant information I've uncovered is this. That some pharma companies are under much higher scrutiny (duh) than others because of the drugs they produce. In some scenarios FDA approval is actually voluntary, and predictably, these companies just use basic security hygiene. Those that are required, typically use a higher degree of security.
I still don't understand the people who go full on "tin foil hat", and I'd still like to understand why. To your point, Deyan, I think that trade secrets have something to do with it. But these are pharma ads. By the time a pharma company is going to market, the basics (at least of what is going to be in an ad) should more or less be known.
