The Importance of IT Security in Your Merger Acquisition

In the business world, mergers and acquisitions are commonplace
as businesses combine, acquire, and enter various partnerships.
Mergers and Acquisitions (M&A) are filled with often very
complicated and complex processes to merge business processes,
management, and a whole slew of other aspects of combining two
businesses into a single logical entity.

In the modern business world before and after the acquisition, a
new concern with M&A activities is cybersecurity. What role
does cybersecurity play in today’s mergers and acquisitions of
businesses? Why is it becoming a tremendous concern?

Cybersecurity threats are growing in leaps and bounds

There is no question that cybersecurity risks and threats are
growing exponentially. A report from Cybersecurity
Ventures^[1] estimated a ransomware
attack on businesses would happen every 11 seconds in 2021. Global
ransomware costs in 2021 would exceed $20 billion.

It seems there are constantly new reports of major ransomware
attacks, costing victims millions of dollars. Earlier this year,
the major ransomware attack on Colonial Pipeline resulted in
disruptions that caused fuel shortages all over the East Coast of
the United States. It helped to show that ransomware attacks on
critical service companies can lead to real-world consequences and
widespread disruption.

This world of extreme cybersecurity risks serves as the backdrop
for business acquisitions and mergers. A Garner report estimated
that 60% of organizations who were involved in M&A activities
consider cybersecurity as a critical factor in the overall process.
In addition, some 73% of businesses surveyed said that a technology
acquisition was the top priority for their M&A activity, and
62% agreed there was a significant cybersecurity risk by acquiring
new companies.

Risks associated with Mergers & Acquisitions

What risks are associated with mergers and acquisitions? There
are several that include but are not limited to the following:

• Increased regulatory scrutiny
• Inherited cybersecurity risks
• Compromised accounts and passwords
• Lost or damaged customer confidence
• Data breaches in the acquired environment

Increased regulatory scrutiny

Compliance regulations, like cybersecurity, are growing more
complex and challenging for businesses. For example, regulators
scrutinize business deals, including mergers and acquisitions, to
help protect the growing emphasis on data sovereignty and data
privacy.

From a cybersecurity perspective, businesses that merge or
acquire other organizations must make sure data compliance is a top
priority to prevent fines for non-compliance.

Inherited cybersecurity risks

Companies must realize that even if they have a robust
cybersecurity posture for their organization, the security dynamic
can completely change with mergers and acquisitions. As a result,
they inherit the cybersecurity challenges and issues of the
acquired business.

The acquiring company inherits existing vulnerabilities,
standards, risks, and cybersecurity liability as they assume
control of the new business.

Compromised accounts and passwords

As was the case with the Colonial Pipeline hack in May 2021,
compromised account passwords are often the culprit behind major
data breaches and ransomware attacks. As a result, businesses must
understand securing acquired accounts and directory services
immediately and implementing breached password protection is a
priority.

Scanning the newly acquired environment for password
vulnerabilities, reused passwords, breached passwords, and other
password threats can help to quickly bolster the cybersecurity
stance of the acquired user account assets.

Businesses that have combined due to a merger or acquisition may
federate Active Directory accounts between them to access various
resources. Password synchronization between on-premises and cloud
directory services may also be in play. It further emphasizes the
need to strengthen password security as accounts are granted access
to additional business-critical resources.

Lost or damaged customer confidence

Businesses must take care of any merger or acquisition from a
customer perspective. Any misstep, including handling cybersecurity
during an acquisition or merger, can lead to customer mistrust and
lost business.

Data breaches in the acquired environment

As mentioned earlier, the acquiring company that has merged or
acquired another company inherits the cybersecurity challenges and
risks of the newly acquired environment. These risks include any
potential data breaches. Knowledge of a data breach event can even
stall or block a potential merger or acquisition once known. Data
breach events can also go undisclosed to prevent any issues with
the merger or acquisition.

Cybersecurity and compliance checklist for M&A

1. Form an M&A cybersecurity team
2. Review the target business cybersecurity posture
3. Inventory all physical, digital, and data assets of the target
   organization
4. Revisit the risk assessment
5. Engage a third-party security company

1 — Form an M&A cybersecurity team

Businesses often have excellent reasons for engaging in M&A
activity. However, as discussed thus far, it can lead to additional
cybersecurity risks. Forming an M&A cybersecurity team is a
great idea to accelerate addressing the cybersecurity tasks
involved with the M&A. This team may report to the CIO and
should undoubtedly include cybersecurity leaders found on the
security teams and key business leaders within the
organization.

This team will be directly responsible for formalizing the
reporting structure for addressing the cybersecurity risks
discovered with the M&A activity. The team will also help to
align the overall business on both sides for a consistent
cybersecurity posture.

2 — Review the target business cybersecurity posture

The M&A cybersecurity team mentioned above will be
instrumental in reviewing the target business cybersecurity
posture. The review of the target organization’s cybersecurity
landscape should include:

• A cybersecurity risk assessment
• Review of security policies and procedures
• Recent audit reports
• Any breach reports that have happened recently or in years
  past
• Audit of accounts and account access permissions across the
  organization

3 — Inventory all physical, digital, and data assets of the
target organization

To properly understand the cybersecurity risk involved with an
M&A of another organization, businesses must understand the
complete inventory of all physical, digital, and data assets.
Understanding and having a comprehensive inventory of these items
allow full disclosure of the cybersecurity risks involved.

4 — Revisit the risk assessment

Any M&A activity means an organization needs to revisit its
risk assessment. Even a recent risk assessment has now changed due
to the reasons we have already covered (inherited cybersecurity
risk, any security or compliance challenges, etc.).

5 — Engage a third-party security company

The M&A cybersecurity team may include a wide range of
technical expertise with a wealth of experience in many
cybersecurity disciplines. However, even with talented team
members, organizations may opt to engage a third-party security
company with the technical and staffing resources to help with
cybersecurity discovery, remediation, combining security resources,
and many other tasks.

Quickly manage M&A password security during

Password and account security can be challenging to manage and
secure during a merger or acquisition of multiple companies.
Specops Password Policy^[2]
provides organizations with tools to secure their native Active
Directory infrastructure and any other directory services they may
manage.

One of the blind spots with any merger or acquisition can be
weak, reused, or even breached passwords lurking as a hidden
cybersecurity threat. Specops Password Policy provides Breached
Password Protection that provides continuous scanning and alerting
of any breached accounts found in the environment.

Organizations can quickly remediate any lax password policies
found in the target organization with Specops Password Policy. It
provides the following features:

• Multiple custom dictionary lists
• Breached Password Protection, protecting against over 2 billion
  breached passwords. This protection includes passwords found on
  known breached lists as well as passwords being used in attacks
  happening right now
• Easily find and remove compromised passwords in your
  environment
• Informative end-user client messaging that is intuitive during
  password changes
• Real-time, dynamic feedback at password change with the Specops
  Authentication client
• Length-based password expiration
• Customizable email notifications
• Block user names, display names, specific words, consecutive
  characters, incremental passwords, and reusing a part of the
  current password
• GPO-driven targeting for any GPO level, computer, user, or
  group population
• Passphrase support
• Over 25 languages supported
• Use Regular Expressions for further password filter
  customization

Specops Password Policy Breached password protection

By bolstering password security in target environments,
businesses can protect mergers and acquisitions from one of the
most common vulnerabilities leading to compromise. Learn more about
or start a free trial of Specops Password
Policy tools with Breached Password Protection^[3].