Insider Threats: An M&A Dealmaker's Nightmare

When it comes to insider threats, business and security leaders are facing a harsh reality. Last year, there were 50,000 mergers and acquisitions (M&A) transactions worldwide, with a total value of about $4 trillion. The biggest concerns for dealmakers? They were not what you might expect. For more than a quarter of them, it wasn't typical issues related to valuation, integration, or execution; instead, it was insider threat and other cybersecurity issues.

The risk of data loss or data theft increases during M&A. Employees, especially at the sell-side company, will hedge their bets and prepare for the worst. "What does this deal mean for me? Is my job safe?" In times of uncertainty, even the best employees may take actions that are out of character in order to keep data that they believe belongs to them.

Consider a developer with high-demand skills at an artificial intelligence startup that was just acquired by the market leader. As part of the deal, the buy-side company announces a reorg. Hearing about the pending layoffs, a recruiter for the competition begins poaching talent with the promise of a big compensation package. Worried about losing his job, the developer accepts the offer. Before he leaves, he transfers some source code to personal cloud storage, thinking it might be useful in his new role. Now, your intellectual property (IP) has walked out the door.

Investing big in a merger or acquisition only to discover that you've lost valuable data is a dealmaker's nightmare. And because data has never been more portable, taking it has never been easier. Employees can store hundreds of gigabytes on their mobile devices, put 1TB or more of data on removable media, or, like the developer, quickly transfer data to personal cloud storage services.

When you consider Deloitte's estimate that IP can account for as much as 80% of a company's value, it should not be surprising that securing the transition of that data will directly affect the success — or failure — of an M&A deal. To better protect their investment, it's time for buy-side companies to take a more holistic approach to data loss protection from insider threats.

Demise of the Castle Metaphor
Since the dawn of technology, security has been built around a castle metaphor. The idea is that your network and data is inside a castle that you need to fortify and safeguard. If you build a big enough "moat," everything will be fine. This philosophy assumes that cybercriminals and malicious attacks are outside the moat, and that anything and anyone inside the walls of the castle should be inherently trusted.

However, the notion that you can trust everyone "inside" and prevent all of your sensitive or confidential data from being exfiltrated or compromised is flawed thinking. Data loss "prevention" is a ridiculous promise. Losing data is inevitable.

The Broken Promises of Legacy DLP
To guard against insider threat and data loss during M&A, many buy-side companies opt for a traditional data loss prevention (DLP) solution. They install DLP software on the endpoints of the sell-side company and put strict policies in place to ensure sensitive data doesn't leave the castle.

The problem is that these restrictive policies get in the way of employees getting their jobs done. The policies fail to account for new data being created as the companies work together through the M&A process. They also throw off alerts every time a user moves data that has been classified as sensitive. For many employees, however, moving sensitive data is a completely normal and necessary part of their everyday work. The end result for security teams? Rigid classification rules that simply can't keep up and a flurry of false alerts that are nothing more than noise.

Protect Everything and Trust No One
There is a better way to safeguard data and streamline the M&A process. Rather than trying to identify and tag select files as sensitive, organizations should have visibility to all their data and where it lives and moves.

This approach fundamentally shifts the emphasis of a data security program from prevention to protection by focusing on speed of detection and response. It works based on the assumption that all data is important. Sales pipelines, forecasts, competitive campaigns, customer contact information, product road maps, prototype drawings — they're all critical IP. And when you buy a company, you should be entitled to all the parts.

This next-generation approach to DLP also assumes that you trust no one. In other words, next-gen DLP software doesn't care if an employee is a trusted user or not. It works at the data level, tracking and monitoring all data activity and flagging anomalies, while keeping copies of all files for fast retrieval and analysis. In an M&A situation, you want to see the data you're paying for, keep it, and protect it if it is threatened. Data blind spots will only leave your deal open to more risk.

When done right, M&A is a great way to grow a company and gain a competitive edge. Having the right data security strategy and tools in place will keep your process on track, while protecting your investment. You don't want to find yourself in the middle of a data security investigation the next time you're ready to strike a deal.

Related Content:

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.