This tip is part of SearchSecurity.com's Corporate Mergers and Acquisitions Security Learning Guide.
Mergers and acquisitions create a challenging set of circumstances for IT departments. Although deals may be announced quickly, the systems integration efforts that follow can take several months -- if not years -- to complete.
It's common for a newly combined organization to try to improve its efficiency by combining its Web application infrastructures. While such an endeavour can lead to a number of security-related challenges, the best path to success requires an unbiased examination of security mechanisms and informed decisions on which ones work best and which need to be added or replaced.
Web application merger risk analysis
When two organizations merge, it's certain that they will have different security philosophies, policies, technologies and requirements regarding Web application security. For example, an ecommerce site that allows customers to track order progress has to permit deeper access into the back-end system than one that merely generates an email once the order is completed. Change control could be another area of conflict if one organization has embraced blog and wiki technologies to communicate with employees and customers.
Because of each company's separate approaches and needs, a combined team from both organizations must be charged with assessing the new entity's risk exposure and setting targets for the merged Web security operation. This risk analysis, which should take place during the due diligence review of the acquired company, involves identifying the key business drivers, workflow needs, budgets, timelines and performance benchmarks in order to gain an understanding of the security policies and the business logic behind the existing security infrastructure.
But before the two merging organizations combine their Web application infrastructures, a comprehensive penetration test should evaluate the strength of their perimeter defenses, as well as the security of remote access and third-party connections. During this period, both organizations should continue to operate separately. Once these tasks have been completed, the organizations' security postures will be clear. Penetration tests can help determine whether fundamental security objectives are being met and flag any shortcomings that might have implications for the merging of Web-based applications.
Security is often linked directly to specific applications, particularly Web-based ones. Before implementing any changes in security defenses and procedures, you will need to evaluate their impact. Probably the greatest area of concern will arise once customer-information databases have been consolidated. Application and user access privileges should be reassessed and data validation routines on all applications re-evaluated to ensure they correctly handle any changes to data fields. Any changes to the way an application processes information should be reviewed to ensure that the application isn't suddenly vulnerable to a logic-based attack. Next, business continuity and disaster recovery plans should be updated and tested, along with physical security and incident response procedures. As the organizations begin to merge, network capacity issues may arise. During any transition, system and application stability need to be monitored so that disruption to business processes is kept to a minimum.
Conclusion
Although it is a challenge to maintain Web application security during mergers, such events provide an opportunity to reduce costs, impose a standard set of security technologies and look at new ideas and security management models. Many organizations find it useful to have a central security figure that is responsible for all security processes. It is often considered a more effective model, as it ensures that security is more coordinated and resources are better utilized. After all, resource utilization is what drives company mergers in the first place.
Corporate Mergers and Acquisitions Security Learning Guide
M&A: Merging network security policies
Best practices for compliance during a merger
Ensuring Web application security when companies merge
Mergers and acquisitions: Building up security after an M&A
About the author:
Michael Cobb, CISSP-ISSAP is the founder and managing director of Cobweb Applications Ltd., a consultancy that offers IT training and support in data security and analysis. He co-authored the book IIS Security and has written numerous technical articles for leading IT publications. Mike is the guest instructor for several SearchSecurity.com Security Schools and, as a SearchSecurity.com site expert, answers user questions on application security and platform security.
