Buying a company means buying its security debt
Feb 26th, 2024 by Jesper Kråkhede
In the US a large healthcare payment company was hit by ransomware this month, and the effects on pharmacies and hospitals are enormous. The company had been acquired by a larger group a couple of years ago and, according to what has been reported, the integration into the group´s IT and security was not complete.
I see this pattern all the time. A company buys another, the business is integrated quickly, but the IT stays separate for years. Two Active Directory forests, two cloud tenants, two sets of security tools, two SOCs or none. And somewhere in the acquired company there is an old remote access portal with only a password in front of it.
Why is it so hard technically? Identities must be merged or connected without giving everyone access to everything. Trusts between forests often open more than intended. Security tools have different coverage, and the acquired company´s environment is often older and less documented. And for a while, the security team has to watch two environments with the people of one.
What helps? Start with the identity. Bring the acquired company´s users and admins under the same Conditional Access and the same protection of privileged accounts from day one, even if the systems stay separate. Avoid broad forest trusts. Use cross tenant synchronisation for collaboration.
And bring the security monitoring together. Microsoft just made multitenant management in Microsoft Defender XDR generally available. It gives the SOC one view of incidents and lets them hunt across all tenants, without logging in and out of each one. That is exactly what you need while the integration is in progress.
Day one of the acquisition is day one of the attacker´s opportunity.