There are many things to consider during M&As, and working through a cyberattack should not be one of them.
#Remove font collection from office for mac plus
What are the potential impacts of a cyberattack during an M&A?Ĭrowley: Some of the potential impacts would be loss of intellectual property that sets up a competitor, or a nasty surprise after the deal is complete that includes paying out a substantial ransom, plus the associated costs of remediation, legal, staff time, and revenue loss, while trying to transition the company to new ownership. Many companies have adopted the NIST Cybersecurity Framework or the CIS Controls standard.ĭo they have a CISO in place or an equivalent CISO-as-a-service? If it appears that there has been limited investment in cybersecurity, they may want to have an assessment done before deal closure to determine what investments are required to mitigate cyber risk to the acquiring company. What steps can companies acquiring a new organization take to mitigate cyber threats?Ĭrowley: Those responsible should ask if there is a cybersecurity program in place and how the program measures up with an appropriate standard. The merger press release may feel good, but if cybersecurity is substandard, it might be best to hold off until the companies are in a better cybersecurity position and have beefed up cyber defenses. If possible, have all cyber defenses in place before going public with the merger. Be aware that the company may be on a criminal's radar screen. The reasoning behind this is to determine if any significant gaps need to be remediated before proceeding.ĭon't present the company as a soft target. Are processes in place to notify all employees that cybercriminals may be targeting the company's digital assets?.Are those responsible well versed in cyberattack detection and remediation?.Are appropriate security controls in place?.For example, ask the following questions: The second step is to ensure existing cybersecurity tools and processes are working and up to date before announcing the M&A. SEE: Incident response policy (TechRepublic Premium) Having a checklist of who to call and what resources those responsible for cybersecurity will need to clean up the mess will help them get through the process faster and with less impact than if they need to spend the first 24-72 hours figuring out what needs to be done. It could damage the company brand, customer relationships and put the business in a poor competitive situation when trying to merge a business or execute on a new ownership arrangement, so there is a reluctance to share the company's "dirty laundry." What steps can businesses being acquired take to mitigate cyber threats?Ĭrowley: The first step, if it is not already in place, is to have an incident response plan. Why aren't more companies aware of the increased likelihood of a cyberattack during an M&A?Ĭrowley: It's embarrassing to report this type of cybercrime. In the case of ransomware, they will obtain access to sensitive files, encrypt them-so applications and business processes stop working-and demand a ransom payment from the company to regain access to the files. If it's an intellectual property attack, they may steal product designs, pricing information or other sensitive business information and leave without anyone knowing there was a breach.
Once they have found credentials to access systems, they can move around the networks and applications to determine where the most sensitive data is. A phishing attack via email is a pretty common and effective approach. The cybercriminal could use a variety of methods to get into the network.
If you sold a business to a large company or a private equity firm, they would have a lot more resources to pay up than if you were a smaller stand-alone organization without a strong balance sheet. SEE: Checklist: Mergers & Acquisitions (TechRepublic Premium) Why are cybercriminals targeting companies undergoing a merger or acquisition (M&A)?Ĭrowley: They are attacking these companies for the same reason people used to rob banks: it's where the money is. To learn more about this overlooked vulnerability, Crowley answered the following questions. "However, by enacting Operational Technology security measures, organizations can avoid an exciting company milestone becoming an infrastructure and security nightmare." "Companies that are being bought and sold are often prime targets for cyberattacks," explained Jim Crowley, CEO of cybersecurity solutions provider Industrial Defender, during an email question-and-answer session. Cybersecurity is one of the last things on upper management's radar during a merger or acquisition, but it should be one of the first considerations.
0 kommentar(er)
