The document discusses security challenges in mergers and acquisitions. It notes that acquired companies or divisions often have weaker security than the parent company. Attackers seek to exploit these weaker links to gain access to the larger company's systems. The document recommends starting security planning early in the M&A process through due diligence. It also suggests conducting a security gap analysis and network segmentation when integrating an acquired company. Establishing security ownership and developing an M&A security playbook can help mature security practices for mergers and acquisitions over time.

1. Security in Mergers and
Acquisitions (M&A)
Going After the Weak Link
November 29, 2017
Security in Mergers and Acquisitions -
Unclassified – External – Approved. V.2.0
Miriam Levenstein

2. © 2017 NTT Security
1. Introduction
2. The Challenge of M&A
3. Weak Branches Bring Down a Strong Tree
4. Solution Approach
5. Maturing the Process
November 29, 2017Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.02
Contents

3. © 2017 NTT Security
Miriam Levenstein, Senior Consultant, Professional Services
NTT Security
Miriam.Levenstein@nttsecurity.com
3
Introduction
Expertise
Governance, Risk and Compliance, Privacy, Mergers & Acquisitions, Business
Continuity
Major
Assignments
• Engaged on M&A due diligence and integration projects for global corporations.
• Perform security assessments and privacy impact assessments (PIA) based on NIST
800-53 framework for state healthcare agencies.
• Conduct Capabilities Maturity Model (CMM) assessment based on the Cyber Security
Framework.
Certifications
• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• PCI Qualified Security Assessor (PCI-QSA)
• Certified Information Systems Auditor (CISA)
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

4. © 2017 NTT Security4
The Challenge of M&A
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

5. © 2017 NTT Security
Although not always recognized as such, Information Security Governance,
Risk and Compliance (GRC) principles are critical in M&A processes of:
• Due diligence
• Integration of acquired companies
• Divestiture and transitioning services
These principles apply to any program to integrate one entity (agency,
division or company) with another.
5
Secure M&A Processes are Key
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

6. © 2017 NTT Security6
Going After the Weak Link
Attackers know that a company is only as strong as its weakest link.
• When seeking access to valuable company data, such as intellectual property, credit
card data or health information, attackers will try to infiltrate email, network shared
drives, and other resources.
• In order to control core IT services, they often find that an indirect route is the most
successful.
• A large company typically will have strong cybersecurity defences at its corporate
headquarters, but security may be lax at the company's acquired divisions.
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

7. © 2017 NTT Security7
Attackers Get Inside
An attacker will look for acquisitions and subsidiaries in order to find insecure
perimeters, such as firewalls that allow Telnet or Remote Desktop access
directly to the internal network.
• Once inside the acquired company's network, the attacker then seeks connectors into
the central corporation through Active Directory federation or connectivity put in
place for databases and applications.
• If the attacker finds a link, that opening is used to gain a foothold inside the well-
secured corporate network.
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

8. © 2017 NTT Security8
How They Find You
• Many acquisitions are publicly announced in press releases and noted in industry
journals and news feeds.
• Additionally, public companies include the list of their subsidiaries in SEC filings,
which can be searched online at www.sec.gov.
• Most organizations also release Annual Reports online, with merger and acquisition
information included to demonstrate the company's strategy for growth.
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

9. © 2017 NTT Security9
Weak Branches Bring Down
A Strong Tree
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

10. © 2017 NTT Security10
Why Aren’t Acquisitions More Secure?
It is initially difficult to understand why an organization would not secure its
acquired divisions. However, this is often a management decision based on
business priorities.
• For example, consider an international manufacturer (Acme) that has purchased a
small start-up (Genius). The start-up, which has developed a unique technology,
consists of just eleven people -- ten engineers and one office manager.
• When Acme first bought this start-up, a key engineer threatened to walk off his job if
he was restrained in any way by new policies and procedures.
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

11. © 2017 NTT Security11
The Tale of Acme & Genius
Acme assumed that over time Genius would adapt to
the parent company’s culture, policies and procedures.
• But the engineers at Genius took pride in being able to
work around the information security that Acme tried (at
times) to impose.
• When Acme’s corporate security put a firewall between
the development lab and the production network, the
chief engineer walked into the wiring closet and unplugged
the firewall. "Honey badger don't care," he said.
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

12. © 2017 NTT Security12
Where Is the Oversight?
• The engineering team at Genius found ways around Acme’s corporate
requirements, installing rogue access points, routers and switches.
• Internal audit performed a site visit, and these problems were reported back
to corporate.
• However, the issues were given low priority because they were found on an
"acquisition network.”
• There was no clearly defined OWNERSHIP and responsibility for the
acquisition’s network, data and systems.
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

13. © 2017 NTT Security13
Why It Matters: The Attack
Eventually, hackers discovered this small division of Acme where users were
domain administrators and developers had access to production systems; where
there was no network segmentation between development, test and production.
• Numerous avenues for infiltration had been left open. VNC, without encryption, was the
remote access protocol in use.
• Once inside, the hackers found the golden key – the small shop's Active Directory was
integrated into the main corporate Active Directory.
• They gained access to the corporate Active Directory, email and network shared drives,
using a compromised administrative account.
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

14. © 2017 NTT Security14
Solution Approach
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

15. © 2017 NTT Security15
Start at the Start: Due Diligence
In due diligence, the acquiring company reviews
documentation from the "target,” the company it may buy.
The acquirer should ask for and review:
• Information security and privacy policies and procedures,
• Security training programs
• Audit reports,
• Vulnerability scan and pen test results
• Network maps
• Any other relevant administrative and technical documents.
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

16. © 2017 NTT Security16
Security and Compliance Gap Analysis
The security program at the target company should be reviewed in light of the
existing security framework used by the acquiring (parent) company.
• The parent company may comply with PCI DSS, HIPAA or other regulations.
• How does the security at the target company compare? What are the gaps?
• This gap analysis will provide a baseline to understand how the acquired company differs
from the main corporation.
• Be aware that the acquisition may bring with it new compliance requirements,
especially in the case of international deals.
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

17. © 2017 NTT Security17
Network Architecture and Technical Security
Implement technology and network architecture to secure the network while
allowing connectivity that is needed.
• Initial connectivity for Day One may be limited to a secure portal or virtual desktops.
• When network connectivity is established for integration, carefully review firewall access
control lists. Intrusion prevention controls and network monitoring should be enabled.
• Evaluate risk and apply technical solutions, including data loss prevention (DLP), user
behavior analytics (UBA), and multi-factor authentication (MFA).
• Include acquisition systems in vulnerability and compliance scans, penetration testing,
and other security tests.
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

18. © 2017 NTT Security18
Incident Response and Handling
Develop and document an incident response
procedure that clearly states responsibilities of
team members at the acquisition site and the
corporate headquarters.
• Perform incident response testing to validate
response to incidents at acquisition sites.
• Consider forming a team with representatives
from all branches and acquired companies in
order to coordinate enterprise response to
widespread issues.
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017
https://xkcd.com/1354/

19. © 2017 NTT Security19
Don’t Forget the Human Factor
The security of data depends on
employees who understand and carry out
their role in protecting information.
• Security awareness and training should be
extended to acquired companies as soon
as possible.
• Training should be enjoyable, interesting,
and tailored to the audience.
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

20. © 2017 NTT Security20
Maturing the Process
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

21. © 2017 NTT Security21
Develop an M&A Playbook
Document the processes and procedures for Information Security activities in
Mergers and Acquisition, from Due Diligence through Integration.
• Develop a Playbook and maintain it as a living document, reviewed frequently.
• Build security in from the start.
• Include architecture diagrams and technical solutions for integration and network
connectivity.
• Address all phases of Mergers, Acquisitions and Divestitures.
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

22. © 2017 NTT Security22
Establish Ownership for Information Security
Clearly state who is responsible for information security at acquisition
sites.
• Clarify funding, lines of reporting, and shared responsibilities.
• Coordinate with Internal Audit, Legal, HR and governance councils on compliance and
enforcement.
• Input findings from security assessments into a Risk Register and/or Plan of Actions &
Milestones (POAM).
• Include M&A security in the organization’s overarching information security risk
management program.
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

23. © 2017 NTT Security23
Mergers and acquisitions drive business growth, but bring a
multitude of risks.
Cyber security risk is part of that.
By addressing security governance at the beginning, at due
diligence, and tracking risks throughout the integration process,
companies can gain control over the information security and
compliance risks in mergers and acquisitions.
In Conclusion
Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017

24. © 2017 NTT Security
Thank You!
24 Security in Mergers and Acquisitions - Unclassified – External – Approved. V.2.0 November 29, 2017