What are the security challenges and opportunities during a M&A?<\/strong><\/p>\n\n\n\nA M&A of a business unit rather\nthan an entire business entity introduces an additional level of complexity. When\nbuying only part of a business you have to have a clear path to cut over\nsecurity context as no co-existence is usually possible.<\/p>\n\n\n\n
It’s\ncommon that merging organizations have different approaches to digital identity\nmanagement and differing opinions on how to secure them. This is more common\nwhen both parties already have their own public key infrastructure (PKI)\nenvironment and processes that need to be integrated. Each organization will\nhave its own set of identities and templates that have already been deployed\nand their own way of managing applications.<\/p>\n\n\n\n
What\nmany organizations fail to realize is that a M&A provides the perfect\nopportunity to incorporate an enhanced digital identity management platform to\nboth elevate overall security capabilities and optimize the IT project work\nassociated with the M&A.<\/p>\n\n\n\n
From\na security perspective, the organizations on either side may generally lack\nsecurity visibility of integrated servers and applications. Having a tool in\nplace to detect and report on these issues can ensure that the new security\nteam is able to quickly assess weaknesses and respond to them quickly, instead\nof being caught off guard by future audit findings. <\/p>\n\n\n\n
When\nthe merging organizations have multiple PKI environments, the issuing\nCertificate Authorities (CAs) from both environments need to be distributed to\nall endpoints across the combined organizations. This ensures that all\ncertificates can be trusted. If teams miss this step, application whitelisting\ncan fail on security devices and SSL connections to enterprise applications\ncould fail or perform inconsistently, overwhelming the help desk. SSL interception\ntechnologies such as WAN accelerators, SSL Inspection devices and proxy servers\ncould also cause traffic blocks if their issued certificates are not trusted by\nall entities.<\/p>\n\n\n\n
Do these challenges extend to liability related to an unknown breach at the acquired company like Verizon\/Yahoo?<\/strong><\/p>\n\n\n\nPotentially.\nIn the case of the Marriott\/Starwood breach, Marriott accepted and assumed\nresponsibility for the breach even though it happened prior to the\nmerger. In the case of Yahoo and Verizon, past breaches at Yahoo forced a\nreduction in the acquisition offer price, leading to a lower valuation of Yahoo\nand shared liability for any litigation arising from the breaches.<\/p>\n\n\n\n
What are the key areas to look at when considering IT spend for a M&A?<\/strong><\/p>\n\n\n\nHaving\nthe right identity management tools in place at the beginning of the engagement\ncan make a difference in the success of the project, especially since a M&A\ncan open up new IT budget opportunities. Corporations realize that they will\nneed to invest in new tools and services to complete the M&A activity.\nOrganizations often create special integration budgets to absorb activity costs\nand write them off as spending related to the M&A.<\/p>\n\n\n\n
When\nit comes to digital identities, there are three key IT spend areas specific to\nthe M&A process:<\/p>\n\n\n\n
- Tools \u2013 Having the right tools in place can help\nminimize labor costs associated with the M&A, as well as long-term IT\nmanagement costs. The right platform should make all digital identity\nmanagement tasks more efficient and data more accurate. <\/li><\/ul>\n\n\n\n
- People\n\u2013 Ensure that you have enough people to do the job\nright. Digital identities are a key piece of your overall security strategy. A\nM&A isn\u2019t the time to cut corners. Ensure that you are adequately staffed\nto address the issues that come up and correct them. This may include bringing\nin consultants or additional staff during the M&A.<\/li><\/ul>\n\n\n\n
- Security\n\u2013 Redesign and rebuild during a M&A provides the\nopportunity to make improvements. Your environment should always be more secure\nafter a M&A than it was before. Digital identity is a key attack vector for\nsecurity incidents and must be continually improved. If you are migrating your\nCAs during a M&A, take the opportunity to put additional safeguards in\nplace. Here are a few examples of improvement opportunities that may present\nthemselves:<\/li><\/ul>\n\n\n\n
- Consider\noutsourcing your infrastructure to PKI management experts.
- Implement new\ntools for auditing and reporting of certificate use. Improved\nvisibility of your environment for how certificates are being issued and\ndeployed will greatly increase your ability to detect and respond to incidents\nquickly.<\/li><\/ul>
- Implement HSM\ntechnology to secure critical identities. At\na minimum, this should be included the storage of your issuing CAs, as well as\nhigh-value certificates such as code signing certificates or certificates used\nfor external facing critical systems.<\/li><\/ul>
- Implement a secure\ncode signing solution. Signing your\ninternally developed code and scripts can greatly increase your security\nposture. It can enable technologies such as application whitelisting and secure\nsoftware deployment tools. Since code signing certificates are critical assets\nin your company, make sure you have a solid plan of how to manage these\ncertificates prior to deployment.<\/li><\/ul>
- Improve physical\nsecurity. If the M&A project requires you to move equipment,\nmake sure that the new data center has security controls in place for best\npractice deployment. Secure your assets with secured cabinets or video\nsurveillance systems.<\/li><\/ul>
- Implement new\nautomation technologies to allow automated certificate management and\ndeployment. This can be done in conjunction with DevOps projects\nthat may kick off as a part of the integration.<\/li><\/ul><\/li><\/ul>\n\n\n\n
Why is a M&A a perfect time to implement the proper enterprise tools for digital identity management?<\/strong><\/p>\n\n\n\nMany\napplications will need to be moved or re-platformed as a result of the merger.\nHaving a tool in place to quickly issue certificates and deploy them to the\nappropriate locations is vital and helpful in reducing or eliminating manual\nprocess that can slow down integration tasks and cause human errors.<\/p>\n\n\n\n
What are the common questions about digital identity that should be addressed during early integration phases during a M&A?<\/strong><\/p>\n\n\n\nThe\nfirst step is always to assess what you really need to merge. This is true for all\nIT infrastructure. The digital identity function is commonly overlooked by\norganizations as unessential and many organizations often begin addressing it\nfar too late in the process.<\/p>\n\n\n\n
Here\nare some common questions about digital identity that must be answered early in\nthe process:<\/p>\n\n\n\n
- What\ncertificate authorities are in use? (public and private)<\/li>
- How\nare certificates issued and what is the approval process?<\/li>
- What\ncertificates already exist in the environment and where are they installed?<\/li>
- How\nare code signing keys issued and secured and who has access to them?<\/li>
- Who\nhas the ability and access to perform certificate management tasks?<\/li>
- Are\nany applications or infrastructure components reliant on these issuance\nprocesses for automation?<\/li>
- How\ncan we establish enterprise wide trust for identities from both organizations?<\/li>
- How\nmany certificates do we have in use before and after this migration? (Note: If\nyou are currently relying on a digital identity management product that relies\non per-certificate fees, this could have a significant impact on the project\nbudget.)<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"
When companies merge or get acquired, the buyer assumes tremendous liability as a data breach can cost many millions of dollars or more. In fact, cybersecurity can be considered perhaps the ultimate landmine in the acquisition process because it can be hidden and cause a massive explosion. Moreover, just like a land mine, it is<\/p>\n","protected":false},"author":44,"featured_media":1869,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[156],"tags":[2918,1796,2917,1133],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/posts\/17732"}],"collection":[{"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/comments?post=17732"}],"version-history":[{"count":2,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/posts\/17732\/revisions"}],"predecessor-version":[{"id":17735,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/posts\/17732\/revisions\/17735"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/media\/1869"}],"wp:attachment":[{"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/media?parent=17732"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/categories?post=17732"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/tags?post=17732"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-content\/uploads\/2020\/07\/Chris-Hickman-Keyfactor-Chief-Security-Officer.png\")