Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/6/2015
06:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Could Security Concerns Scuttle M&A And Investment Deals?

Questions of investor notification of Slack breach prior to signing shows how important security posture will be in vetting future deals.

Last week's breach of communication software start-up Slack offered a great example of how information security is not just a big consideration of customers and business partners, but also potential investors and acquiring companies. Increasingly, financial experts believe that the examination of a company's IT security posture should be as much a part of the due diligence process prior to investment or mergers and acquisition activity as an ROI analysis should be.

In the case of Slack, the breach occurred just after the company was rounding up $160 million in investment. According to a report from the Wall Street Journal, "It’s unclear when Slack discovered the breach or if new investors were told of it before they agreed to the deal." Because the funding story was the result of leaked information from confidential sources and the company is pretty closed-mouthed over the deal, it may be hard to ever know if the breach has or will materially impact the closing of Slack's latest funding round. But one thing you can bet on is that as large-scale breaches continue to gain awareness in the board room, M&A and other investment deals may include security contingencies to cover investors' backsides.

"I could foresee a situation in which, number one, a deal might go through, but one of the terms is that certain upgrades and certain measures be taken from a data security perspective between the time of signing and closing," says Scott Vernick, head of the data security and privacy practice at the law firm Fox Rothschild LLP. "And, two, I could see closing contingent upon there being no material adverse changes, just like anything else. I could also see certain holdbacks from the purchase price if the buyer determines that you've got to spend $5 million or $10 million or whatever it is to bring someone up to best practices or a more robust security environment."

As Vernick explains, though security evaluation adds yet another layer of complexity to the already arduous due diligence process, it is something that shouldn't be optional within the vetting process for M&A.

"If I was sitting on a board, now in addition to asking all the questions you would normally ask, like 'What's this going to do for us?' and Where do we see our ROI and how quickly will we realize it?' the next question is 'What liability from a data security persepctive are we taking on?'" he says. "Because the last thing that you want to do is end up doing a merger or acquisition and then becoming responsible for a whole other set of liabilities because you have no real understanding of what the data security is of the target."

This means understanding what kind of data it collects from customers, how it collects it, what other intellectual property assets it has, where it keeps that data, how long it keeps it and who has access to that data. Those should all be part of the baseline questions asked during due diligence, he says.

Also important is ensuring that whoever asks those questions has the technical knowledge to capably ask the right questions and analyze the answers to truly understand the picture of risk they paint. This may be a role that the CISO plays in the acquiring company.

"In a typical deal you have due diligence which is done by a combination of in-house resources,  outside counsel and an investment banker," Vernick says. "Now you're going to have to make sure that one of those three or somebody else that you bring on board  has the technical skill set to ask the right questions." 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/13/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-14300
PUBLISHED: 2020-07-13
The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) included an incorrect version of runc that was missing multiple bug and security fixes. One of the fixes regressed in th...
CVE-2020-14298
PUBLISHED: 2020-07-13
The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the co...
CVE-2020-15050
PUBLISHED: 2020-07-13
An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server via Directory Traversal.
CVE-2020-10987
PUBLISHED: 2020-07-13
The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.
CVE-2020-10988
PUBLISHED: 2020-07-13
A hard-coded telnet credential in the tenda_login binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a telnetd service on the device.