Application Security

7/9/2018
05:30 PM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail

6 M&A Security Tips

Companies are realizing that the security posture of an acquired organization should be considered as part of their due diligence process.



Image Source: Shutterstock via Sylverarts Vectors

Image Source: Shutterstock via Sylverarts Vectors

There’s a growing sense that companies need to take a closer look at security when considering a merger or acquisition.

A global survey of dealmakers by Mandiant, a FireEye company, found that 78% of respondents believe that cybersecurity is not analyzed in great depth or specifically quantified as part of the M&A due diligence process.

"Although most security teams feel strongly that the security posture of an acquired organization should be considered in an acquisition decision, it often does not play a significant role in the deal team's due diligence process," says Charles Carmakal, vice president and CTO of strategic services at Mandiant. "The reality is that security generally only plays a role during the acquisition if there's a significant breach. In that situation, the security team would evaluate if the asset is too toxic and has lost value."

Chad Holmes, chief services and operations officer at Optiv, adds that cybersecurity has risen in importance because many more companies are acquiring digital assets as part of their digital transformation initiatives. He cited a a study from Capgemini Consulting that finds 87% believe that digital transformation gives them a competitive advantage.   

We talked with Carmakal and Holmes to develop this list of M&A security tips. For more information, check out the Mandiant study, "The Benefits of Cybersecurity Diligence in Mergers and Acquisitions."

 

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
To Click or Not to Click: The Answer Is Easy
Kowsik Guruswamy, Chief Technology Officer at Menlo Security,  11/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19301
PUBLISHED: 2018-11-15
tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrator later views the system log.
CVE-2018-5407
PUBLISHED: 2018-11-15
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
CVE-2018-14934
PUBLISHED: 2018-11-15
The Bluetooth subsystem on Polycom Trio devices with software before 5.5.4 has Incorrect Access Control. An attacker can connect without authentication and subsequently record audio from the device microphone.
CVE-2018-14935
PUBLISHED: 2018-11-15
The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS.
CVE-2018-16619
PUBLISHED: 2018-11-15
Sonatype Nexus Repository Manager before 3.14 allows XSS.