There’s a common assumption that mergers and acquisitions put organizations at more risk of cyberattacks. Is there any data to back up this well-worn trope?

Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Christina Shannon, CIO, KIK Consumer Products. Joining us is Andrew Cannata, CISO, Primo Water.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Cyera

Full Transcript

Intro

0:00.000

[David Spark] There’s a common assumption that mergers and acquisitions put organizations at more risk of cyber-attacks, but is there any data to back up this theory?

[Voiceover] You’re listening to Defense in Depth.

[David Spark] Welcome to Defense in Depth. My name is David Spark. I am the producer of the CISO Series. And joining me as a guest cohost… We’ve actually had her on before as a guest cohost, and we’ve had her on as a guest, too. Thrilled to have her back. It is none other than Christina Shannon, who’s the CIO of Kick Consumer Products.

And by the way, she’s been a CISO many times as well, too. Christina, thank you so much for joining us.

[Christina Shannon] Thank you very much for having me, David. Always a joy to be here.

[David Spark] Awesome. Now, I do want to mention our awesome sponsor for today’s episode, and that is Cyera, holistic data security in one cloud platform. We’re going to be talking more about data security a little bit later in the show, but first let’s get to our main topic at hand here, Christina.

It’s not too hard to see why a merger or acquisition could increase risk to an organization, right? But Michael Santarcangelo of Security Catalyst asked on LinkedIn, “Do we have evidence that this actually leads to an increase in actual cyber-attacks?” We have a lot of anecdotal evidence. I mean, people have said things.

But do we have hard figures to back up what is kind of an obvious gut feeling? I mean, A, have you seen it, or is it mostly a gut feeling, and you’ve got anecdotal stories yourself, Chritina?

[Christina Shannon] I’m torn between is there evidence that a merger and acquisition can directly cause a cyber attack versus is it the integration of systems and increase of vulnerabilities that leads to a cyber-attack. That’s where I’m a little bit torn, and I would probably go with the latter.

[David Spark] And what we’re going to see from the discussion that Michael Santarcangelo had is that it is the actual makeup of what is happening that’s inviting it, I think. And everyone is sort of on kind of high alert during this period in time because it’s happening. And then what sort of unfolds afterwards.

But we have someone perfect to discuss this very topic with us, and I believe he’s had a lot of experience in this area as well. It is none other than the CISO of Primo Water, Andrew Cannata. Andrew, thank you so much for joining us.

[Andrew Cannata] Very excited to be here. Thank you for having me.

What do most people think it is, and what’s the reality?

2:27.865

[David Spark] Allan Alford of the Cyber Ranch Podcast said, “I used a fake TechCrunch article about an impending merger, the merger was actually real, but the article was fake, as clickbait on a phishing test. Now, my previous click rates down in the low single digits, and they shot right back to over 30% with that one email.

I even got the CEO to click. That’s when I realized phish clicking stat were useless. If it’s compelling enough, people will click.” And Derek A. said, “I went through a large M&A announced in 2017. It was all over the news. We didn’t see any measurable uptick in anything. I don’t remember a single phish that was using the M&A as a lure.” So, two conflicting accounts here, Christina.

One who actually used it as a lure, one who actually had one and didn’t see a lure. I got to imagine… I guess in Derek’s case, he just got lucky because I got to assume… We see this on holiday weekends, that you’ll get a phishes around the holiday. So, people are just targeting an incident, right, Christina?

[Christina Shannon] Yeah. I mean, I think that most people probably think a little bit like Derek where they probably think that it’s not going to directly cause an uptick, but I think that they’re probably assuming that a lot of the cyber security risk type discussions are happening through standard IT due diligence during mergers and acquisitions, and they’re probably not really thinking about the fact that the systems that are being inherited, which is the reality is is that cyber-attacks, they increase significantly during M&A due to the integration challenges and temporary security gaps.

I think comprehensive cyber security due diligence, like I said before, is often overlooked, and I actually went and read that AYON, they estimate that less than 10% of global deals include comprehensive cyber security due diligence. So, yeah, I definitely think that I’m probably more where Allan is.

I do think that where that differs again is probably where is it targeted versus untargeted and then percentage of breaches.

[David Spark] All right, Andrew, you were nodding your head a lot, especially just it’s like, “Hey, it’s around the holidays.” Or you even get the attacks during the Super Bowl that mention the Super Bowl.

[Andrew Cannata] Right. In fact, I just actually sent out a reminder to our entire population saying, “Hey, you’re going into a long holiday weekend here. You might want to take a half a second and think about things before you click or open an email from somebody that you don’t recognize.” So, I certainly do agree that in times of distraction, whether it’s M&A distraction, or holiday distraction, or just life in general, we are more susceptible to not taking that five-second pause, deep breath, “Why would the CEO be sending me a text telling me that he needs me to be in this meeting and to bring gift cards on the way into the meeting?” Anybody with a half a second of pause would say, “No, that’s not happening.” I’m right down the fence on this with both of the quotes here based on my experienced here and previous organizations.

[David Spark] And the thing is with a merger and acquisition, so much needs to be communicated, and it’s a lot of very high level information that needs to be communicated and highly sensitive information. So, people are actually expecting these kinds of communications at these times. So, like when you make a comment like that to your team just about the holidays, that makes sense.

But people are expecting this communication, right?

[Andrew Cannata] You would hope. The question is are they reading it, and are they actually paying attention to it, and are they going to take that half second pause and not click, not open an email, not forward it, or not go to a site to download something that’s going to cause all sorts of grief and consternation for them and the rest of the organization later?

[David Spark] Christina, in your experience with mergers and acquisitions, do you have a sort of like you have to do second factor check type thing? Like if you see something weird, pick up the phone and call the person?

[Christina Shannon] yeah. I mean, I think that that awareness element is super important. I think that… Like I said, I think that a lot of… To Andrew’s point, a lot of focus is on closing the transaction. Well, first, it’s signing the purchase agreement. It’s closing the transaction, and it’s, “How do we get off the TSA?” And all of that is warp speed seemingly when you’re going through it, and so there’s not a lot of focus on how could what we’re doing that’s in the news be exploited.

So, I think that awareness is where that comes in. Now, again, to Andrew’s point, people have to pay attention, and they have to read a little bit, but that’s one of the ways to try. [Laughs]

What’s our visibility into this problem?

7:29.605

[David Spark] Jeff Pick of Freeport-McMoRan said, “I haven’t seen anything related simply to an uptick in attacks based on an announcement. However, I have seen empirical data from sources like Security Scorecard and/or BitSight that clearly show a correlation to an overall drop in security posture scores post-merger announcement and even more after merger completion.

I can only assume that as uncertainty looms, some of the basics fall to the wayside while the dust settles.” And Dwayne S., Global CISO over at PrismHR, said, “Look at the FedEx acquisition of a European company. The Marriott acquisition of Starlight. It is hard to tell if these incidents occurred because they were targeted or changes that permitted the integration of the computing resources.” So, it’s interesting here… One of the concerns we hear… We’ve done sessions about mergers and acquisition, Andrew, and they talk a lot of you are inheriting somebody else’s security posture, and how is that happening to you.

And one security posture is going to be worse than the other. [Laughs] They’re not going to come in as equals. So, the fact that a posture lowers is not a surprise and that what Jeff said about the scores start lowering. So, it may just be the inevitable result of inheriting somebody’s security posture.

[Andrew Cannata] I mean, you can choose your family, right? And there is sarcasm in my voice there. Without question as you bring o a new entity into your organization or divest an entity, you are going to be inheriting or giving away your security posture in some way, shape, or form. I think to the earlier point as well, if you’re distracted and you are trying to integrate multiple organizations into a single platform or a set of platforms, you’re going to miss things.

And I have some concern as that happens that just the speed of the deal and the importance of the deal puts you in a position where maybe your pants aren’t all the way down around your ankles, but your fly is a little unzipped there at the top. You don’t want to be in that position in a public forum ever.

[Laughter]

[Andrew Cannata] So, we certainly take that portion of our due diligence and post close very seriously in our organization, and we’ve been very fortunate that that’s been the case thus far.

[David Spark] So, Christina, what have you done to, in the past…? Because there is going to be a security posture that’s going to be lower than another, and it’s conceivable you’ll inherit one that’s better. Who knows. I mean does that happen? I have no idea. But that, I guess, has to be acknowledged and has to be dealt with as fast as possible.

[Christina Shannon] Absolutely, yeah. To Andrew’s point, it’s super important to have…as soon as possible to have the inclusion at the deal team, before the purchasing agreement to where you can really do that risk identification to understand if you’re doing an acquisition what you’re inheriting, what type of risk exposures you have.

And then as you’re implementing or during the deal phase in terms of the TSA while you’re trying to either obtain the systems or an investiture, or you’re doing a carveout, that’s where that real-time monitoring, vulnerability management…that’s where all those controls come into play, and those can’t be a nice to have.

Those must be a must-have, and they have to be in place from the start.

[David Spark] Andy Ellis, who’s one of my other cohosts, when they dealt with mergers and acquisitions, in some elements they didn’t even look. They just said everyone is getting new computers. They wouldn’t even… “I don’t even want to look at anybody else’s computer.” And he goes, “Everyone is getting a new computer.

This is what it is. Get rid of the old ones. I don’t care,” kind of thing.

[Christina Shannon] I was just going to say, I think in large organizations… Because I’ve been in large and mid-size.. And I think in large organizations, that’s probably more the norm than not that I’ve seen. And the mid-size private, I would say it’s not. I think that’s where you run into less security aware deal teams where…

[David Spark] And by the way, it would be far cheaper probably to just…if you have a much smaller organization, far cheaper to buy 100 computers than to deal with this nonsense.

[Christina Shannon] Oh, I agree. But I think sometimes the problem is that the deal team doesn’t still know that they’re supposed to involve the IT team or the security team until after they sign the purchasing agreement. Right? I would start there. It’s like how do you get to the table before the agreement is signed.

[Laughs]

Sponsor – Cyera

12:23.714

[David Spark] Before I go on any further, I do want to tell you about our absolutely spectacular sponsor, and that is Cyera. We all know that data is the largest and fastest growing security attack surface in the world. Every business is using data to collect insights and create new products, but they have to do it without placing the business at risk.

Solving data security starts with knowing your data. Now, this is exactly where Cyera’s data security platform can help. This is key. Just identifying your data is essentially the pathway to data security. So, discover your data attack service. Monitor, detect, and respond to data risk, and help govern data use.

Let me give you a scenario. Imagine if your organization’s OneDrive was compromised by ransomware. Would you know what data was in the OneDrive? Would this trigger a compliance issue? And how much would it cost you to use outside counsel to determine materiality? Cyera delivers the insights you need and answers all these questions.

It all starts with their agentless approach to data discovery, which occurs across any environment – cloud, SaaS, even on premises – making deployment fast and simple. Cyera’s classification is based on their own LLM and has an accuracy of 95%. Companies like Paramount Pictures trust Cyera to discover their data, its sensitivity, and who has access to it.

To learn more visit cyera.io. Go check it out.

What else are we missing?

14:08.136

[David Spark] Rich Mason of Critical Infrastructure said, “The other side of M&A is that a good due diligence process will uncover signs of previous or active compromise.” That’s interesting. “The upside is that it can inform your go/no-go decision, might be a factor in valuation – are you buying for IP, which is already gone, or for channel – and can inform your integration plans and timeline.” And we were just talking about like get there and early, and I know, Andrew, you’ve had good experience with that as well, and I know there’s been a lot of complaints from other CISOs not being in early enough.

Let me also just add this last quote from Thilak Dharmananda of ES2 Solutions. “In most cases threat profile change as the organizations involving the M&A have different culture, technologies and process which may conflict leaving confusions, disagreements, technology protocol mismatches, integrations of systems.

Basically the context changes, threat landscape change, also people and process.” So, Thilak kind of just at the very end there just says, “A lot of things changed.” Yes, Christina?

[Christina Shannon] I like what Rich said, which was basically… I think of what he said almost as like that security by design, right? Or again is getting in early. But he’s basically saying that’s strategic in the sense that if you could get in early enough, due the due diligence then you could find issues that may save you the heart ache later of maybe you don’t do the deal because it’s not what you thought it would be.

But doing that early due diligence could show such from an exposing risk exposure standpoint.

[David Spark] No, and it’s critical to your value. Andrew, let me ask you… Thilak’s response here is so all encompassing. I get the sense that a merger and acquisition sounds like you’re starting a whole new security program again. Has that been your experience?

[Andrew Cannata] Well, I don’t know if you’re actually starting a whole new security program again. What I do know is that you are going to be affecting change in both organizations. You are going to be bringing their culture into yours and affecting your culture into their environment, and that’s going to be a combination of the information security posture, their privacy.

The whole organization changes drastically post-merger. I do think it really is dependent upon the maturity of the organization that is doing the acquisition and the organization that is being acquired. So, I don’t have any issue with either one of the quotes here. I think they’re actually both accurate.

In my previous experience, I have seen both of these things play out over that time. So, yeah, I don’t know if I’m supposed to make a definitive decision on one or the other. I actually like both of them.

[David Spark] The answer… It depends, sadly, is the answer. By the way, very little in security is always one way or the other. In fact, I remember asking the question, “Is there anything in security that is set it and forget it?” And they said, “Not even ethics are et it and forget it,” because sadly that changes sometimes, too.

[Laughs] Christina, coming back to you on this last one, do you feel that you’re doing an overhaul of your security program during an acquisition and merger, or it’s never that painful?

[Christina Shannon] I have never been through one that is fun. They’re all painful at different times. [Laughs] But I always call that growth. [Laughs] But I would say that what you’re doing is that you’re looking at the systems that you’re inheriting. From a standpoint of a controls and controls maturity, I think it is almost like a re-baseline of your security program in that you’re looking at this entity I’m bringing in from a risk identification to a what do we have in place that’s protecting our environment, what do we have that’s detecting anomalies, what do we have…how can we respond and recover.

I think from that sense, you are really doing a mapping to understand how mature is this organization I’m bringing on. And I think about United Healthcare’s acquisition of Change Healthcare when I say that. I believe, if my understanding is right, that was a Citrix vulnerability that led to that ransomware, and so that’s just an example.

It’s like did United Healthcare have that in their inventory? I’m assuming they did, but it was probably such a speed, and they had so much that how do you get…? They might have missed that there was a vulnerability. So, I think it’s not necessarily bringing in or starting over, like Andrew said. But I do think it’s integrating what was the controls in the entity that you’re acquiring with your current for your current organization.

No one said it would be easy.

19:11.381

[David Spark] Corey Wrenn said, “M & A is the perfect time for the goons to slide through. All of the different business areas talking to new people across the bow they’ve never talked to before. All the things that gotta get done. Perfect time for a hacker to inject themselves into financial processes, recruiting processes, trouble ticket resolution, etc.

But the real answer is any time is the perfect time.” But I think Corey kind of hit the nail on the head, saying a lot of this is happening, why not join in on the fun, right, Andrew?

[Andrew Cannata] Yeah. In fact, I’ve got to meet this Corey guy because he thinks exactly like I do, which God help this gentleman. I agree.

[Laughter]

[Andrew Cannata] When everything is going crazy around you, why not as a bad guy… In my former world when we were brought in to do attack and penetration testing activities, we would actively do the OPSEC in advance. So, we’d go out and do the research, figure out what was going on in that organization’s world, and figure out a way to exploit that as a part of the active penetration testing efforts.

And if we had the opportunity to do a social engineering on top of the active pen test, forget it. It was like a kid in the candy store. We had so much fun doing those types of activities during these types of processes. In our world now, we see how things are so crazy. I mean our organization does multiple acquisitions on an annual basis.

We generally mature who we’re acquiring. In fact, we almost always mature that organization. But we do that through a pretty defined systematic process. We ensure the training is there. We communicate effectively. We go back to the old, “If you see something, say something.” We just reiterate it multiple times to put us in a position where we’re not working 24 hours, 7 days a week, 360… Well, for several weeks at a time to recover from an incident.

So, I actually… As soon as we’re doing with this recording, I’m going to look this Corey Wrenn fellow up and introduce myself because I agree with what he says without question.

[David Spark] I throw it to you, Christina. Christina, I think Corey just summed up our entire session here, didn’t he, with this quote.

[Christina Shannon] Yeah. I think Corey’s quote is spot on. It’s like the perfect storm. Whether it’s human error or insider threats, APTs, system integration, compliance, dealing with third party risk management. It’s a perfect storm. [Laughs] And it’s definitely the perfect time for goons to slide through.

[David Spark] Let me tell a quick story. I was talking to my mother, and she was telling me about somebody who had their house broken into. And she goes, “They must have known because they targeted these specific things and took these specific things.” I’m like, “Yeah, of course. Why would someone break into a house if they didn’t know what they were doing?” And I think we have to think about everything like that now.

Yes, there are sort of the mass attacks, like, “Let’s see who will fall for it.” Like sort of a watering hole style attack. But in general, people are going to know something about you. It’s like they’re going to case out the joint before they actually break in. And so you just kind of assume this is the standard, right, Andrew?

[Andrew Cannata] Well, unless they’re very lucky or very poor at their job, right? And don’t do that research prior to coming in and trying to take out your organization in some way, shape, or form. And there are dumb criminals out there. I mean, we’ve all seen all the news stories about it, and there are lucky criminals out there as well.

So, yeah, I agree 100%, David. If you are going through a time of change in your organization, somebody has to be watching for the bad guys at the gate. And knowing that this integration between your organization and the new one is going to cause so much distraction, that’s the time that you really need to ratchet it down even more and pay even more attention.

And good luck with that. If anybody figures out how to squeeze more hours into a day, give me a call because I’m all ears at this point.

[David Spark] You could use a few extras.

[Andrew Cannata] Yeah. Amen.

[David Spark] All right. Well, Andrew wants to meet Corey and also anyone who can add more than 24 hours in a day. He’s all for that.

[Christina Shannon] [Laughs]

[David Spark] And I’m assuming Christina is the same way as well.

Closing

23:49.958

[David Spark] All right, we’ve come to the portion of our show where I ask both of you which quote was your favorite, and I think I kind of know the answer because we talked about it a lot here at the end, but I will start with you, Andrew. I’ll let you have the first call on this. Your favorite quote and why.

[Andrew Cannata] Clearly my favorite quote was Corey Wrenn’s. And not only the language that he uses, because it’s near and dear to my heart, the concept that he put forward makes perfect sense to me, and I couldn’t agree with it anymore. Now is the time to pay attention. Because if you don’t, don’t worry.

The bad guys are.

[David Spark] Good point. All right, Christina, your favorite quote and why. And you can say Corey again or somebody else.

[Christina Shannon] So, my favorite is Dwayne S. I do agree that you have to understand that you’re probably going to be targeted and understand that they’ll probably look at your profile to figure out how to get in. Just like your story, David. But I also think that I liked his point, again, where he said it’s hard to tell if the actual data breaches or incidents occur because they were targeted, or was it just that you have an influx of changes in the environment that increase your risk exposure that permitted the integration of vulnerable computing resources?

I think that’s fair.

[David Spark] Good point. All right. Excellent for both Dwayne and Corey. All right. Well, that brings us to the very end of the show. I do want to thank our spectacular sponsor, and that is Cyera. Holistic data security in one cloud platform. We don’t hear enough about data security, and that’s so bizarre because that’s what it’s all about.

Right? Check them out at cyera.io. All right. I want to thank our guest, who is here, Andrew Cannata, who is the CISO over at Primo Water, and also my guest cohost who’s been on many times before, Christina Shannon, who is the CIO of Kick Consumer Products. Chritina, are you hiring, by the way, at Kick?

[Christina Shannon] Yes, I’m hiring. Check us out at kickcorp.com.

[David Spark] Kickcorp.com, and they can contact you if they have questions…

[Christina Shannon] Yeah, absolutely. Contact me on LinkedIn.

[David Spark] Awesome, thank you very much. And thank you to our audience. We greatly appreciate your contributions and for listening to Defense in Depth.

[Voiceover] We’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cyber security. This show thrives on your contributions. Please write a review, leave a comment on LinkedIn or on our site, ciso-dev.davidspark.dcgws.com, where you’ll also see plenty of ways to participate, including recording a question or a comment for the show.

If you’re interested in sponsoring the podcast, contact David Spark directly at david@ciso-dev.davidspark.dcgws.com. Thank you for listening to Defense in Depth.