Category: Cyber Security

Originally posted on October 14, 2020 @ 4:50 pm

In my professional career, I’ve seen several mergers and acquisitions from the inside. Whether it was from the acquiring company or acquired, as an individual contributor, manager or executive, each had one thing specifically in common: it was the most dangerous time for both organizations’ information and data.  Long before any public announcement, there are a lot of moving parts to make the M&A happen, Leadership from both companies, IT professionals  and security for both companies are directly involved.  Then there are all the people unofficially “in the loop” who happen to be connected directly to the pulse of the companies. After the announcement, there are the usual suspects interested in the announcements, competitors, bankers, lawyers, etc.  But in addition, to the legitimate and expected interested parties, hackers are paying attention to any changes to your organization.

Managing risk during M&A activities can be a full time job.  There are many factors and motivations to consider, not to mention the rapidly changing environment as two different companies and cultures collide. Step usually taken to minimize or reassign risk are signing non-disclosure agreements (NDA), implementing corporate communication firewalls (not the network device), and insurance. There are many threats associated with an M&A, some external, other’s internal, some risks you’ll just have to accept, other’s you can take steps to mitigate or eliminate. In addition to mitigation, there are ways to significantly reduce certain internal risks associated with the M&A activity.

Internal threats are those within an organization, and can be looked at in two broad categories, unintentional and intentional. The intentional threats are no different than what might be included in a typical insider threat program and under normal operating procedures so I’ll not address them here.  The unintentional threats primarily occur through poor or limited communications.  The unique environment created by M&A makes your organization ripe for phishing and social engineering attacks.  Generally, people are unsure of who’s in charge, who has organizational authority, and where responsibility lies.  This uncertainty, creates an opportunity for attackers to use various attack vectors to compromise your new company.

Given the complexities, uncertainties and issues surrounding information security during an M&A, there are some practical solutions that can make a significant impact to these internal threats.

1. Publish the high level corporate structure as soon as possible. The sooner your employees understand at least the high level structure, the faster they will understand who should have information and where corporate authorities lie.
2. Establish a process for validating requests by the transition team and senior leadership. Any requests for PII, money transfers or other corporate decisions should be validated by multiple methods, E-mail, phone, face to face, etc. No single communication should trusted.
3. NEVER use an e-mail or phone number that isn’t validated through the corporate Global Address List (GAL) or directory to provide any corporate data. A common practice is to request the victim to call the hacker on a different number to validate the request, giving the victim a false sense of security.
4. Train your employees to question all visitors to your facilities, work with security to issue badges for all new employee’s immediately. It is too easy for an attacker to impersonate an employee of the partner company and wander around the new office, asking questions, getting printouts and files.

Remember, during M&A everyone is nervous, people worry about their jobs, they are trying to impress their new management or just save their jobs.  This nervousness can lead to mistakes or major data breaches.  Keep vigilant, communicate across the organization and establish rules to validate requests and you can avoid some of the most common pitfalls of data protection during a merger or acquisition.

Originally posted on December 16, 2020 @ 6:19 pm

Originally posted on July 14, 2020 @ 7:23 pm

We’ve all been tempted at one time or another to connect to that public WiFi connection at the airport, Starbucks or the hotel. Whether it’s because you’ve reached your data plan limit, or the cellular signal is just too poor to get a decent data rate it; crosses everyone’s mind from time to time. That’s a dangerous decision that many people make every day without thinking of the potential consequences and inherent risks.

Public WiFi, by definition, is easy for the public to access and use. Because of that, administrators rarely put significant security in place to protect the users connecting to their networks.  The danger of connecting to the public WiFi is who’s listening.  The technical term is Man-in-the-Middle (MiTM) attack. A MiTM attack is where an attacker intercepts the communication between two parties and sometimes alters it or uses it (in the case of username and password) later. When connecting to your corporate WiFi network, there is generally more security including stronger passwords, and encryption for those who access the system. On your home network you are protected by the passwords and encryption you’ve setup on the network and the number of users who can physically connect to your network (based on proximity).  Of course, if you live in a Condo, TownHouse or Apartment, there are many more people who can receive the WiFi signal than if you live in a single family home, but I’ll discuss home/corporate WiFi security at another time.

A real world example of a MiTM attack was uncovered by Kaspersky Lab in 2014 called “Dark Hotel”.  Dark Hotel operated for more than seven years before being discovered and is believed to be a sophisticated economic espionage campaign by an unknown country. Dark Hotel targeted CEOs, government agencies, U.S. executives, and other high-value targets while they were in Asia. When executives connected to their luxury hotel’s WiFi network and downloaded what they believed were regular software updates, their devices were infected with malware. This malware could sit inactive and undetected for several months before being remotely accessed to obtain sensitive information on the device.

This all sounds terrible and I HIGHLY recommend, NEVER connect to a public WiFi. But I know that sometimes it is just impractical to do anything else.  So if you must connect, here are some precautions and recommendations:

1. Don’t do online shopping, log into your financial institution or other sensitive activities on public networks.
2. Use 2-factor authentication when logging into sites when possible (including Gmail).  2-factor authentication ensures that malicious users cannot log into your account at a later time without both authentication mechanisms (like your password and cell phone)
3. Whenever possible, use HTTPS for websites.  It encrypts the data and makes you a harder target.
4. Turn off File sharing, automatic connections, and other services that would transmit your password or open you up to an attack.
5. Use a Virtual Private Network (VPN) service.  This encrypts your data from the computer to another device on the Internet and ensures that no one connected to the local network can eavesdrop on your communications.

Even doing all of these steps could still result in a compromise when connecting to a public network if someone is determined to attack your device.  Implementing these steps will ensure that you’re more protected and a harder target than the guy sipping the latte next to you and hopefully, the attacker will go after them instead. Your best bet is to buy a MiFi, implement personal hotspot capabilities on your cellular phone or buy an unlimited data plan so you don’t have to use someone else’s network to get to the Internet or other online resource.