While announcing the latest venture may feel good, the acquiring organization should consider holding off the announcement if the target acquisition firm has substandard cybersecurity levels.
The past couple has seen a significant increase in ransomware attacks. As per flare systems’ “The State of Ransomware in 2021,” ransomware attacks have increased by 437% between 2020 and 2021. Industry experts state that most of these ransomware attacks occurred after the merger or acquisition announcement.
According to the “Financial Trend Analysis” report from Financial Crime Enforcement Network, the average amount reported on ransomware transactions was the US $ 102.3 million. This cost is typically tied to the loss of revenue, ransom demands, legal fees, incident response costs, hardware/software replacement, and increased cyber insurance premiums. This can be significantly increased when cybercriminals become aware of an organization being bought and accordingly can increase their ransom. Additionally, M&A develops a period of transition, where new ownership and management teams are coming into or out of their roles. This provides a perfect opportunity for cybercriminals to attack.
With the implications of a potentially detrimental cyber-attack, especially to those acquiring the organization, both parties must take the necessary steps to minimize the detrimental effects of cyber-attack.
Also Read: What Companies Need to Know About Securing the Metaverse
-
Evaluate cyber-risk for due diligence
This should be the primary requirement for any organization when looking at its target acquisition. By evaluating the cyber-risk of the target organization, acquiring firms can ensure that existing cybersecurity resources, processes, and technology are working properly before finalizing and announcing the M&A.
With a cyber due diligence process in place, both parties can determine any security gaps in the process that needs to be addressed. The people responsible should then ask whether they have an appropriate cybersecurity program in place and how the program measures up with an appropriate standard.
-
Having an incident response plan
When a security incident occurs, organizations should know they have their priorities sorted and plan in advance. This will let responders know how they can get through the recovery process faster with less impact than if they have spent the first 24-72 hours figuring out what actions they need to take. They should also create a checklist for knowing who is responsible for which functions and have clear communication. This will allow them to prevent the spread of malware.
Another critical aspect of the response plan is having details of assets and networks for critical systems. In case of an emergency, organizations will not have the necessary time to determine if they are able to estimate billing while losing their real-time data. Hence, they should ensure they have details of assets and networks for critical systems. Otherwise, they will find to decide if they can continue to operate with their current system.
Also Read: How Long will VPNs be Discontinued?
-
Do not show the acquisition as being a soft target
The acquiring organization should be aware of the fact that threat actors constantly track M&A activity through publicly available information and then research the level of defense a target acquisition has in place. Their research can also find the number of information security people on the staff and the tools the organization may have in place.
If the cybercriminals found out there is no InfoSec function as well as limited cybersecurity investment, they most likely consider the firm a soft target, making it their perfect avenue to launch cyber-attacks. Hence, organizations should ensure they have all cyber defenses in place before moving ahead with the merger.
The bottom line is that if the acquiring organization found that the target firm has made an insufficient investment in cybersecurity during the due diligence phase or does not have a documented incident response plan in place, they should hold off on finalizing the deal. Instead, they should take time to determine what resources are needed to mitigate the cyber risk inside the firm and establish them in the negotiations.
For more such updates follow us on Google News ITsecuritywire News
