Hackers, Insiders Can Threaten M&A Activity, Say IBM, Fortinet
Chinese hackers had already roamed Nortel’s systems for nearly 10 years when, five years after the breach discovery, business communications firm Avaya acquired bankrupt Nortel Enterprise Solutions — and, unknowingly, also acquired that company’s attackers. That was a bellwether moment for the M&A world, says Caleb Barlow, IBM ( IBM ) vice president of security. Until then, an acquisition target’s cybersecurity situation wasn’t a box on the usual M&A checklist. “It was the moment everyone in the M&A community woke up,” Barlow told IBD. “They said, ‘We better be looking at their security posture as well, otherwise you could not only legitimately acquire the company, but also the attacker.” As Barlow recounts, Nortel’s downfall came down to seven passwords, including the chief executive officer’s. Hackers with Chinese IP addresses gained access to Nortel’s network as early as 2000 and so thoroughly dug in that they weren’t discovered until 2004. Avaya, which acquired that Nortel business for $900 million in 2009, didn’t learn of the breach until after its acquisition closed. And even then, the hackers were still entrenched in the system. “No one had really thought about this type of problem before because cybersecurity wasn’t one of the normal things you’d think about in the M&A process,” Barlow said. “In my view, it’s now a critical component.” Quantifying Risk In A Bidding War Consulting firm Deloitte found 70% of 2,500 firms surveyed in 2015 considered security to be a “high” or “very high” priority in M&As. That’s up from 64% in 2014. Both corporate and private equity respondents increased their due diligence efforts over the span of the year. But also in the 2014 Deloitte survey, 78% of firms said security wasn’t a general piece of M&A due diligence, and 66% said rapid-fire M&A bidding made cyber risks “very difficult” to quickly quantify. Deloitte didn’t reiterate those questions in its 2015 survey. Rapid-fire M&As include Apple ( AAPL ) chip supplier Skyworks Solutions ( SWKS ) and Microsemi ( MSCC ) last year facing off in a month-long bidding battle for PMC-Sierra ( PMCS ). Due diligence might or might not have been rushed in that deal, but such aggressive bidding wars are infrequent, Fortinet ( FTNT ) CFO Drew Del Matto told IBD. More often, an acquirer examines a target’s products, financials, policies and systems. IT security is just a new layer of the necessary due diligence. This mindset is new, and there are built-in risks with every piece of due diligence, NSS Labs CEO Vikram Phatak says. NSS Labs independently tests and reports on the efficiency of cybersecurity products, similar to Consumer Reports. It’s likely an acquirer has “a really good handle on the debt the company will have, the expense structure of the company, the historical growth rates,” he told IBD. “Where you get a little sticky is they may not have time to do all the (security-related) due diligence by calling the customers.” Cybersecurity works along the same lines, Phatak says. Tech companies, especially, should have a keen understanding of the security measures in place, BitSight CEO Stephen Boyer told IBD. BitSight rates the cybersecurity posture of about 40,000 companies, similar to a FICO score, so customers can assess their own security risk but also the risks of potential or current partners, vendors and customers. “If you go in and say, ‘Who’s in charge of this (security)?’ and everyone looks around, then you probably have a problem,” Boyer said. Avoiding Post-Merger Slip Even including cybersecurity within due diligence isn’t a surefire protection, Boyer said. Former telecom provider Pacnet discovered a breach on April 3, 2015, after Telstra finalized its $697 million acquisition of Pacnet. Telstra was notified on April 16 — the day the merger completed. An SQL code injection on a Pacnet Web service application server opened hackers to the network, email and administrative processes. Acquirers should be “monitoring that window of due diligence up until the week the deal closes,” Boyer said. “Monitor it all through the process, because there would be a slip-up along the way.” Before signing off on a merger, an acquirer should get a sense of the target’s cybersecurity culture, Barlow says. Examine past incidents — processes, logs and reports. if those documents aren’t available, then there might be a problem. That goes double for a tech company. “If they don’t have those policies in place, then you start asking other questions,” Barlow said. “If they weren’t paying attention to security, what else weren’t they looking at?” Phatak suggests acquirers also scope out a target’s security vendors. Not every cybersecurity vendor is built the same and the quality of a target’s security purchases can be very telling, he told IBD. “Make sure the company you’re acquiring didn’t skimp on security,” he said. “(Products) are not all equal, but from a compliance perspective, a check-box perspective, they all look the same.” Breaches From The Inside Del Matto estimates two-thirds of breaches come from the inside, at the hands of either careless or disgruntled employees. M&A, often accompanied by layoffs, can breed the latter. “When people feel like they’re at risk, they’re more likely to do something that may expose the company to a cyber risk,” Del Matto said. More benign actions, like inadvertently visiting an infected website, can lead to malware attaching on the system. But Del Matto is more concerned about the damage a disgruntled employee with absolute access can wreak. Barlow suggests a company identify its “crown jewel” and then tuck it into a protected place with limited access. That crown jewel could be IP, financial information, client lists, personal information — basically anything worth stealing, Phatak told IBD. “If someone is able to get into the customer list, they could see what deals are in the (pipeline),” Del Matto said. “They may monetize those by selling them or, worse, leaving the company with those lists in their hands.” Beyond guarding that data, an M&A-engaged company should embrace employees into the new culture, he said. Because, “when you buy a company, you buy a competitive advantage. If that leaks out in some other way, you’re destroying the value of the M&A.”