Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/6/2015
06:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Could Security Concerns Scuttle M&A And Investment Deals?

Questions of investor notification of Slack breach prior to signing shows how important security posture will be in vetting future deals.

Last week's breach of communication software start-up Slack offered a great example of how information security is not just a big consideration of customers and business partners, but also potential investors and acquiring companies. Increasingly, financial experts believe that the examination of a company's IT security posture should be as much a part of the due diligence process prior to investment or mergers and acquisition activity as an ROI analysis should be.

In the case of Slack, the breach occurred just after the company was rounding up $160 million in investment. According to a report from the Wall Street Journal, "It’s unclear when Slack discovered the breach or if new investors were told of it before they agreed to the deal." Because the funding story was the result of leaked information from confidential sources and the company is pretty closed-mouthed over the deal, it may be hard to ever know if the breach has or will materially impact the closing of Slack's latest funding round. But one thing you can bet on is that as large-scale breaches continue to gain awareness in the board room, M&A and other investment deals may include security contingencies to cover investors' backsides.

"I could foresee a situation in which, number one, a deal might go through, but one of the terms is that certain upgrades and certain measures be taken from a data security perspective between the time of signing and closing," says Scott Vernick, head of the data security and privacy practice at the law firm Fox Rothschild LLP. "And, two, I could see closing contingent upon there being no material adverse changes, just like anything else. I could also see certain holdbacks from the purchase price if the buyer determines that you've got to spend $5 million or $10 million or whatever it is to bring someone up to best practices or a more robust security environment."

As Vernick explains, though security evaluation adds yet another layer of complexity to the already arduous due diligence process, it is something that shouldn't be optional within the vetting process for M&A.

"If I was sitting on a board, now in addition to asking all the questions you would normally ask, like 'What's this going to do for us?' and Where do we see our ROI and how quickly will we realize it?' the next question is 'What liability from a data security persepctive are we taking on?'" he says. "Because the last thing that you want to do is end up doing a merger or acquisition and then becoming responsible for a whole other set of liabilities because you have no real understanding of what the data security is of the target."

This means understanding what kind of data it collects from customers, how it collects it, what other intellectual property assets it has, where it keeps that data, how long it keeps it and who has access to that data. Those should all be part of the baseline questions asked during due diligence, he says.

Also important is ensuring that whoever asks those questions has the technical knowledge to capably ask the right questions and analyze the answers to truly understand the picture of risk they paint. This may be a role that the CISO plays in the acquiring company.

"In a typical deal you have due diligence which is done by a combination of in-house resources,  outside counsel and an investment banker," Vernick says. "Now you're going to have to make sure that one of those three or somebody else that you bring on board  has the technical skill set to ask the right questions." 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
Microsoft Patches Windows Vuln Discovered by the NSA
Kelly Sheridan, Staff Editor, Dark Reading,  1/14/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14629
PUBLISHED: 2020-01-17
Improper permissions in Intel(R) DAAL before version 2020 Gold may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2019-17125
PUBLISHED: 2020-01-17
A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS.
CVE-2019-17127
PUBLISHED: 2020-01-17
A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation.
CVE-2020-3940
PUBLISHED: 2020-01-17
VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability.
CVE-2020-6862
PUBLISHED: 2020-01-17
V6.0.10P2T2 and V6.0.10P2T5 of F6x2W product are impacted by Information leak vulnerability. Unauthorized users could log in directly to obtain page information without entering a verification code.