There are many real-world examples of the drawbacks of inheriting an organization with unknown \u2014 or at least unmonitored \u2014 IT assets which have been breached. Here is a list of five things that you should look at when evaluating the cybersecurity posture of a merger or acquisition (M&A) target organization.<\/p>\n\n\n\n
And which of those assets can be accessed via the internet? Manual inventory processes often miss new assets, those which have been long since forgotten, or even critical resources like cloud infrastructure, databases and servers. Assets which are directly connected to the internet can be discovered and pummeled by attackers who are opportunistically and indiscriminately looking for easy targets.<\/p>\n\n\n\n
You need visibility to the target organization\u2019s full attack surface. Assets may have been orphaned in your target\u2019s earlier M&A processes, and subsidiaries belonging to the target can introduce their own risks.<\/p>\n\n\n\n
Once you\u2019ve identified all the target\u2019s assets, wherever they may reside, you need to understand which are most important to the business and thus most important to secure. <\/p>\n\n\n\n
You need to thoroughly assess the organization\u2019s security posture to understand which risks are most critical and how difficult it would be to remediate them.<\/p>\n\n\n\n
Finally, you\u2019ll need to effectively communicate your overall assessment of the target organization\u2019s security posture to your broader M&A evaluation task force or team. Assigning a rating to your assessment will have more credibility if the overall score is built upon a solid foundation: scores from the component departments and their assets.<\/p>\n\n\n\n
Taking a security-focused and comprehensive approach when acting on these five recommendations can help you accurately determine the extent of cybersecurity risk the target organization will bring to you should you decide to move forward.<\/p>\n\n\n\n