Common M&A Security Problems

Like most organizations, credit unions tend to build custom software to increase operational efficiency. The challenge is that smaller organizations tend to not perform regular security testing as they build software and have fewer (if any) security touchpoints as part of their software development lifecycle. There's nothing wrong with that; however, challenges could arise after a merger when network and application integration begins because chances are that security assessments will be performed at that time, when some of the most common software and network vulnerabilities are most likely to be identified. According to the OWASP Top 10, a list about the most critical security risks to web applications today, among the most common vulnerabilities, which can be exploited by attackers, are:

Injection flaws, which can enable data breaches where attackers extract data from databases or enable them to create phishing attacks against the application's end users.
Broken authentication, which can allow attackers to view or access data and functionality that they should not have access to.
Sensitive data exposure, which could lead to personally identifiable information data exposure or account data exposure (e.g., credit card number being breached).

A bigger issue, which should make any organization hesitant about proceeding with an acquisition, is if the acquisition target can't tell you its cybersecurity "story." If you discover that your acquisition target handles cybersecurity in a non-systematic, tactical way, raise the red flag. Hackers exploit your weakest link. It doesn't matter how many security controls are in place, if you have one weak system, hackers will figure out a way to get in and exploit it. A common scenario is where the target initiates a security assessment only upon customer request. This is a clear indication that there is a lack of focus or awareness on the importance of security, and will inevitably lead to weaknesses somewhere in the network, the infrastructure where the software's hosted, or within the software itself. Not only will you be acquiring that weakness, you'll also be acquiring the organization's people, who may not have been exposed to proper security considerations as part of their day-to-day jobs.

Instant Insights /

Vulnerability Management Considerations for Credit Union M&As

Related Stories

Recommended For You