August 2, 2017 By Kelly Ryver 3 min read

With all the industry studies, articles and literature related to insider threats, it is baffling to see that very few have focused on how insider threats are acquired — in fact, paid for — during a merger and acquisition process. Organizations are so fixated on driving profits and staying competitive that they gobble up any tangible asset they can. Companies are more likely to begin a merger or acquisition first and worry about the insider threat risk later. This is not a sustainable business practice.

To compound the problem, too many companies are using risk management as a substitute for solid internal security audits that identify problems before the merger or acquisition is initiated. Businesses assume they can manage any risks they might encounter after the merger or acquisition is complete, so they proceed to buy, assimilate and then sell off various parts. These organizations give little, if any, thought to the information security program and controls — specifically, whether the target of the merger or acquisition has those controls at all, and if they do, how effective they are.

Some Food for Thought

Information security consultants with risk management expertise commonly see one of the following two scenarios today, if not both within one environment.

Scenario One

Company A spends years gobbling up smaller companies in an effort to stay competitive and boost profits. Some of these companies are integrated, while others are resold to someone else. Over the course of these acquisitions, a federal government or regulatory audit is completed to determine fiscal liabilities, financial stability, financial solvency, etc. At the conclusion of the audit, Company A is informed that it has failed due to lack of:

  • A defined process for managing the full spectrum of information security responsibilities;
  • Standards;
  • Policies;
  • Procedures;
  • Governance; and
  • A fully defined risk assessment process that leads to a risk management process.

Finally, the company is informed that it must get its regulatory act together within a specified period of time.

Scenario Two

Company A undergoes an independent information security audit as part of its annual or biannual requirement for staying operational or reporting up to a regulatory authority. The company fails the independent audit due to lack of one or more of the following:

  • An information security program (top to bottom);
  • A fully defined risk assessment process that leads to a risk management process;
  • Standards;
  • Policies;
  • Procedures;
  • Governance;
  • Security controls; and
  • Defined roles and responsibilities within the environment.

For both of these scenarios, Company A ends up scrambling to find one or more information security firms that can provide experts in various fields to sort out the big mess, a process that could take up to five years. Meanwhile, insider threats are lurking in the network.

The Big Picture

Many companies don’t realize that it is possible — and much easier — to conduct independent audits when merging with or acquiring another organization. It’s just like buying a new home: Individuals should always have the property inspected before singing on the dotted line.

Another point that companies often miss is that a risk assessment process must exist before a risk management program can be implemented. Too many organizations try to manage risk without knowing what to look at, what to look for, how to rate it, how to apply metrics or which metrics make sense.

But risk management is no substitute for good information security practices. Do not bypass building an information security program in favor of accepting or mitigating every risk that will rear its head.

Finally, it is much easier to build the entire information security program from the top-down (or bottom-up) the right way the first time. The alternative is to piecemeal it, fail a first audit, take a step back to fix one issue, piecemeal some more, fail a second audit, take another step backward and so on.

Practical Advice for Spotting Insider Threats

Companies should follow a few best practices when considering merging with or acquiring another organization. Begin by taking a long, objective look at what is being acquired and why. Ask yourself what an insider would potentially stand to gain by compromising the network.

Next, examine all the security controls in place using an expert or team of experts. Investigate the individuals that will most likely be assimilated into the new environment, and never assume that routine or annual background checks were done or done the right way.

Be very suspicious of any company that mysteriously pops up and offers to perform an internal audit, especially using automated tools. Insider threats have friends just like the rest of us. Also, be wary of any and all hardware or data that vanishes or becomes lost during a merger or acquisition. Such cases warrant a thorough investigation.

Finally, hire a third-party risk assessment firm to examine the environment before the merger is started. Do the same before the transaction is complete, money has exchanged hands and all parties have signed on the dotted line.

Listen to the podcast series: Take Back Control of Your Cybersecurity Now

More from Risk Management

Operationalize cyber risk quantification for smart security

4 min read - Organizations constantly face new tactics from cyber criminals who aim to compromise their most valuable assets. Yet despite evolving techniques, many security leaders still rely on subjective terms, such as low, medium and high, to communicate and manage cyber risk. These vague terms do not convey the necessary detail or insight to produce actionable outcomes that accurately identify, measure, manage and communicate cyber risks. As a result, executives and board members remain uninformed and ill-prepared to manage organizational risk effectively.…

The evolution of ransomware: Lessons for the future

5 min read - Ransomware has been part of the cyber crime ecosystem since the late 1980s and remains a major threat in the cyber landscape today. Evolving ransomware attacks are becoming increasingly more sophisticated as threat actors leverage vulnerabilities, social engineering and insider threats. While the future of ransomware is full of unknown threats, we can look to the past and recent trends to predict the future. 2005 to 2020: A rapidly changing landscape While the first ransomware incident was observed in 1989,…

Defense in depth: Layering your security coverage

2 min read - The more valuable a possession, the more steps you take to protect it. A home, for example, is protected by the lock systems on doors and windows, but the valuable or sensitive items that a criminal might steal are stored with even more security — in a locked filing cabinet or a safe. This provides layers of protection for the things you really don’t want a thief to get their hands on. You tailor each item’s protection accordingly, depending on…

The evolution of 20 years of cybersecurity awareness

3 min read - Since 2004, the White House and Congress have designated October National Cybersecurity Awareness Month. This year marks the 20th anniversary of this effort to raise awareness about the importance of cybersecurity and online safety. How have cybersecurity and malware evolved over the last two decades? What types of threat management tools surfaced and when? The Cybersecurity Awareness Month themes over the years give us a clue. 2004 - 2009: Inaugural year and beyond This early period emphasized general cybersecurity hygiene,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today