Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/6/2015
06:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Could Security Concerns Scuttle M&A And Investment Deals?

Questions of investor notification of Slack breach prior to signing shows how important security posture will be in vetting future deals.

Last week's breach of communication software start-up Slack offered a great example of how information security is not just a big consideration of customers and business partners, but also potential investors and acquiring companies. Increasingly, financial experts believe that the examination of a company's IT security posture should be as much a part of the due diligence process prior to investment or mergers and acquisition activity as an ROI analysis should be.

In the case of Slack, the breach occurred just after the company was rounding up $160 million in investment. According to a report from the Wall Street Journal, "It’s unclear when Slack discovered the breach or if new investors were told of it before they agreed to the deal." Because the funding story was the result of leaked information from confidential sources and the company is pretty closed-mouthed over the deal, it may be hard to ever know if the breach has or will materially impact the closing of Slack's latest funding round. But one thing you can bet on is that as large-scale breaches continue to gain awareness in the board room, M&A and other investment deals may include security contingencies to cover investors' backsides.

"I could foresee a situation in which, number one, a deal might go through, but one of the terms is that certain upgrades and certain measures be taken from a data security perspective between the time of signing and closing," says Scott Vernick, head of the data security and privacy practice at the law firm Fox Rothschild LLP. "And, two, I could see closing contingent upon there being no material adverse changes, just like anything else. I could also see certain holdbacks from the purchase price if the buyer determines that you've got to spend $5 million or $10 million or whatever it is to bring someone up to best practices or a more robust security environment."

As Vernick explains, though security evaluation adds yet another layer of complexity to the already arduous due diligence process, it is something that shouldn't be optional within the vetting process for M&A.

"If I was sitting on a board, now in addition to asking all the questions you would normally ask, like 'What's this going to do for us?' and Where do we see our ROI and how quickly will we realize it?' the next question is 'What liability from a data security persepctive are we taking on?'" he says. "Because the last thing that you want to do is end up doing a merger or acquisition and then becoming responsible for a whole other set of liabilities because you have no real understanding of what the data security is of the target."

This means understanding what kind of data it collects from customers, how it collects it, what other intellectual property assets it has, where it keeps that data, how long it keeps it and who has access to that data. Those should all be part of the baseline questions asked during due diligence, he says.

Also important is ensuring that whoever asks those questions has the technical knowledge to capably ask the right questions and analyze the answers to truly understand the picture of risk they paint. This may be a role that the CISO plays in the acquiring company.

"In a typical deal you have due diligence which is done by a combination of in-house resources,  outside counsel and an investment banker," Vernick says. "Now you're going to have to make sure that one of those three or somebody else that you bring on board  has the technical skill set to ask the right questions." 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Exactly
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4643
PUBLISHED: 2020-09-21
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information. IBM X-Force ID: 185590.
CVE-2020-4590
PUBLISHED: 2020-09-21
IBM WebSphere Application Server Liberty 17.0.0.3 through 20.0.0.9 running oauth-2.0 or openidConnectServer-1.0 server features is vulnerable to a denial of service attack conducted by an authenticated client. IBM X-Force ID: 184650.
CVE-2020-4731
PUBLISHED: 2020-09-21
IBM Aspera Web Application 1.9.14 PL1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188055.
CVE-2020-4315
PUBLISHED: 2020-09-21
IBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the i...
CVE-2020-4579
PUBLISHED: 2020-09-21
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted HTTP/2 request with invalid characters. IBM X-Force ID: 184438.