The danger of not integrating
Feb 20th, 2024 by Jesper Kråkhede
Following my post on security in acquisitions, a word to management.
When you buy a company, you buy its customers, its products and its people. You also buy its security debt, whether you know about it or not. Unpatched systems, old remote access, admin accounts nobody has looked at for years.
The problem is that security integration rarely gets priority. The business case for the acquisition is about revenue and synergies. Security is a cost, and the IT integration is planned for year two or three. Until then, the acquired company runs as before, but now with your name and your customers attached to it. For an attacker, it is the softest way into the group.
So what should management do? Include a security assessment in the due diligence, before the deal is signed. It may affect the price. Set a short deadline, measured in weeks, for the most critical controls: a second factor on all remote access, protected admin accounts and monitoring by the group´s SOC. Budget for the integration as part of the acquisition cost, not as an IT project later. And give the security team the people to do it, because they can´t do it on top of everything else.
An acquisition that isn´t integrated is a door left open. And the door has your name on it.