Mergers and Acquisitions: Addressing the Network in the Room

According to recent research by Deloitte, the biggest hurdle in effectively managing a deal in today's environment is technology integration, and 51% of executives view cybersecurity as their top concern in executing mergers and acquisitions (M&As). But this number should probably be higher, as many security professionals know that M&As are often an open target for bad actors.

M&As give cybercriminals an opportunity to compromise the acquired company in order to later gain access to the bigger, more valuable business. This is almost what happened to Marriott in 2018 after its acquisition of Starwood, whose reservation database was compromised. Attackers will often probe for openings and vulnerabilities in smaller companies that will allow them to gain a foothold into the infrastructure. After the merger, they can use this compromised device to access the larger enterprise's network.

Network and security teams need to carefully account for vital cybersecurity, privacy, and data management practices to ensure effective operations, compliance, and security posture for both involved organizations. But there are ways to approach mergers and acquisitions that can mitigate these risks and drastically simplify the process of integrating the two companies' infrastructures.

The first step starts with understanding the networks.

Reducing Risk Through Understanding
The risk involved in merging the digital infrastructures of major enterprises is simple to summarize: If you don't have full visibility into topology, state, and configuration, you can't secure it or ensure it will continue to work once the networks are merged. With the complexity of modern networks, operations engineers trying to connect two together are often effectively working blindfolded. Unless a team knows how everything is connected to everything else, it is impossible to make informed architecture decisions to change things. And the starting point is always the network.

In today's world of digital transformation, it is more important than ever that teams overseeing M&A integrations both empower and protect themselves by properly approaching network integration through a full understanding of the networks involved. This is by no means a simple task, though. Accessing detailed information about all network devices, firewalls, configurations, and data paths can be difficult for businesses with large and complex networks. Every network is unique, and nothing about the operations or functions can be assumed.

Most network maps and inventories that engineers have available are incomplete or out of date. Trying to manually capture a device list, map out the data paths, note all the configurations, figure out the operational processes, and enforce the networkwide security posture is virtually impossible, even for the most experienced network teams.

And yet, network and security operations need this information to integrate different network infrastructures safely and effectively. As with most tasks that are too complex for humans to complete manually, the answer lies in software that delivers this information in an understandable and actionable format.

The Network Map: X Marks the Integration
After network operations have built an updated map of the infrastructure topology, evaluation for cybersecurity compliance and future integration can finally begin. As any security team that's gone through this process can attest, this involves a lot of steps. From identifying network compliance issues to flagging outdated configurations, locating forgotten equipment, proactively unveiling security violations, alerting operators of unpatched vulnerabilities, and more.

With a live network map, the companies can then evaluate the infrastructure for cybersecurity compliance and for future integration. Tools like port scanning, network configuration checks, and path verification allow IT to see if the network is operating consistently and is compliant with company policies. IT will especially want to focus on solutions that root out existing liabilities, such as vulnerability assessments, penetration testing, and compliance assessments. For instance, a network digital twin allows enterprises to overlay security policies on other networks, allowing for identification of network compliance issues, flagging outdated configurations, locating forgotten equipment, proactively unveiling security violations, and alerting operators of unpatched vulnerabilities.

The Moment of Truth
After network engineers and security teams go through all these steps to understand, analyze, and evaluate the networks, the final step becomes simple. Thanks to the preparatory work done, all network variables are now known, and the upcoming network changes have been predicted and previsualized. By following these steps, the process of connecting and integrating the network infrastructures becomes much less daunting — and more efficient and effective.