Business mergers and acquisitions

 

Business mergers and acquisitions (M&A) lead to the merging of corporations.  It is essential to identify the diverse domains in every company. For instance, financial difficulties, technology/intellectual property systems, client/sales data, management/employee characteristics, compliance/legal responsibilities and operation models, and other vital aspects, should be combined. The sound Acquisition must admit that there is a specific range of risks entailing the due-diligence process. The acquiring company needs to validate the assets, threats, and vulnerabilities or liabilities they are buying.

Concerning modern firm’s scenarios, most corporations’ diverse domains are regulated or influenced in one means or another by information technology as every information, production regulators, and policymaking is achieved through electronic computing settings.  Therefore, cybersecurity is a substantial measure of fruitful merger and acquisition (M&A) developments as governance, threat, and conformity are deliberated all through the procedures of due diligence, finalizing the pact, and assimilating the amalgamated entity.

In this case, the firm to be assimilated is a streaming corporation that consists of a consumer base of 150,000 clients, and their regular payment each month is $14.99. Bearing in mind that the significant number of consumers and the payment method is regularly performed through credit cards signifies that the security apprehensions comprise online cyber risks, user risks, and available information systems and networks risks. Therefore, it is vital to guarantee that the M&A procedure integrates specific aspects into the due diligence process (Sisco, 2015). For instance, information security appraisals’ execution identifies gaps in policy and conformity, prioritizing ways of protecting the target company’s data infrastructure.  It is vital to recognize that the BYOD and wireless, streaming services conventions, and supply chain risk evaluation are significant facets of the due diligence processes.

Introduction

Regarding the technology sector, mergers and AcquisitionAcquisitions between diverse corporations are regularly attributed to various aspects. They include prospects and extortions of economic factors, demand for services and merchandises that the union may improve, changes in regulations that expedite the merge, and lastly, accessibility of capital needed for the merger or Acquisition. The deals that are resolved between two corporations and, in some instances, other corporations that may similarly exist would not only provide aspects that would have an affirmative effect on the organization’s growth and profit margins. Nonetheless, it also results in diverse threats. Several significant threats that are linked to Acquisition may entail cybersecurity, legal and monetary.   It would be necessary and vital for the corporation to carry out a gap analysis for the corporation to be procured. This helps in realizing the aspects that would influence the firm’s valuation and bearing in mind the fundamentals that may be expected and alleviate before approving the pact or any contract.

In this case, a streaming service supplier seeking to acquire a company that offers similar services is vital to conduct a gap analysis to ascertain the target corporation’s monetary, cybersecurity, and legal possibilities. Therefore, the aspects to contemplate comprise market threats, technical assets comprising intellectual property, operations, and prospects and intimidations ensuing from integration. The gap analysis process should typically focus on information technology, as there are the most predominant threats linked to streaming service corporations. The course of ascertaining and re-evaluating the cybersecurity within the M&A situations is denoted as IT due diligence procedure.

The paper is directed at evaluating the effect of cybersecurity analysis and its influence on a prosperous union and purchase. According to Hart Jin & Feenberg (2014), research studies indicate that the cybersecurity study is vital as a monetary and legal assessment during mergers. A cybersecurity evaluation process pre and post procurement would ascertain and help evaluate the gaps in policy for cybersecurity, combined infrastructure, BYOD strategies, operation procedures for the business, and wireless networking (Skoudis, (2017).  It would also offer an opening that may help advance a strong liability defense system, develop a reviewed security plan, generate a data fortification area, and enlighten the consumers with security evaluation reports and other cybersecurity research articles thesis.

Policy Gap Analysis

When a merger or Acquisition is instigated, the information systems and networks are certain to be exposed to cyber-attacks. The entity must carry out a policy gap analysis to ascertain the vacuum besides taking precise action. The cybersecurity policy gap analysis should be conducted on four fundamental domains. They include access control, infrastructure safety, information safeguards, and risk detection (Misata, 2016). Every domain should be analyzed founded on the firm policy, industrial framework strategy, internal security policy, and external policy.

The strategies mentioned earlier aim to aid in establishing essential techniques that would impose and aid in maintaining all-inclusive security. It similarly aids in evaluating the implemented policies contrary to the stated policy gaps and classifying the gaps between the two. Effected policies comprise governance, control, and procedures to help the streaming service provider protect the data within its structures and networks. It similarly aids in offering improved all-inclusive assessment and appraisal of the corporation targeted for procurement together with the four domains. The inquiry should also factor in risk management since it is vital for each organization, which is needed to uphold and execute an all-inclusive information policy. The risk exploration aids in comprehending the risk-handling concept incorporated by the target firm. It ought to be evaluated regarding the duration the risk management policies are assessed and how frequently it is restructured and checked for threats. The risk management should similarly analyze the strategy to check for neutrality, support, and engagement endorsed by the senior administration and proficiency.

The streaming service firm should institute at some level cybersecurity and risk management as a superiority element. The risk evaluation is vital in ascertaining the insufficiencies and faults that may affect the quality ideals in the form of attacks developing risks. Supposing the policy under risk evaluation is incapable of recognizing the common dangers and assaults. In that instance, the streaming service company may be viewed to have no sufficient abilities that would aid in protecting it against the developing and changing risks. Therefore, the corporation may need to make substantial investments to set up and sustain the new security risk management strategy. According to Sell (2015) Gaps in risk management may be realized by re-examining the complete phases and similarly incorporating the penetration tests. It is equally essential that the policy gap analysis assesses the lawful matters and the financial systems to assist in accomplishing a better comprehension of the other characteristics that might be a threat to the company in the aftermath of the merger.

The streaming services are recognized for the enforcement of financial data principles that FCA is well defined under its risk management values and similarly PCI DDS principles. It has been stated that the corporation is recognized to have assimilated 150000 new clients that pay $14.99 once a month as membership. By merger, the company would also be acquiring these online transaction features, which would need to be secured through PCI Security Standard Council regulations and the agency’s guidelines. By union, the firm would also be obtaining the online transaction elements, which would need to be safeguarded through PCI Security Standard Council guidelines and the agency’s procedures.

The FCA risk management standards, PCI DSS standards, Consumer Financial Protection Bureau (CFPB), and the Securities and Exchange Commission (SEC) are examples of corporations that offer rules for safeguarding financial-related information and its elements. Every online deal or information should be stored, processed, or transmitted in a system that complies with all well-defined security principles. Moreover, they should guarantee that the technical and operational system elements comply with the guidelines recognized by every standard.

To guarantee that a secure network for credit card payment information, it is vital to implement a firewall framework along with embedding proper conformations to avert unlawful accessibility to private information. Strong security codes that utilize 12-15-digit code comprising upper/lower case inscriptions, figures, and discrete characters should be implemented. Cardholders should similarly comprehend that they are liable for their credit cards, and the structures used in accessing digital credit data must be fit with anti-virus programs. They must evade apprehensive online programs and web pages. As with the PCI DSS Quick Orientation Guide, having personnel with an improved comprehension of the prospective threats and difficulties from a technical, administrative, and cyber environment standpoint is vital to accomplishing a safe credit card system and policy.

Every user or employee should be allocated discrete access regions, permits, and rights before retrieving any credit card information. Moreover, the assigned special access procedures ought to also be observed through systems that may not be accessible by illegal internal supervisors to elude alteration of forensic-viable information. Ultimately, every employee and credit card system user ought to be handled through an onsite and online transaction structure process together with security responsiveness and training strategy.

The two applicable requirements that are well defined in the PCI Principles DSS 12 set of necessities and significant roles to secure the multiple information structures and systems are firewalls, full-time system, and network administrators (Merchant Industry, 2019).  The most appropriate firewall is considered the Raptor Firewall NT with Virtual Private Network (VPN) and unlimited mobile operators abilities. They are valued at $24,949, and it comes with hardware and software elements that will need yearly maintenance budget that amounts to approximately $ 3,099.

There is a similar need for system administrators to guarantee confident competence is brought into the combined infrastructure. The administrators would comprise examining malevolent or apprehensive behaviors, observing, executing proper conformations, alteration, and investigating automated detection. Moreover, they would physically need to reply to crucial matters such as blocking actions that may be regarded illegal. The average annual salary is approximately $72,000 per annum (Indeed, 2020). It is vital to have about three to four individuals guarantee appropriate working, aided with the automatic tool for network study.

To offer a layer of extra security, setting up several firewall packages may likewise be helpful. This would comprise Firewall suites, Security Analyser, and additional tools. For this Kaspersky Endpoint Cybersecurity, advanced suited would offer a comprehensive defense at $960 each year (Kaspersky, 2020). The firewall is considered to help execute an instantaneous tool that would observe, manger and report both in-bound and outbound undertakings whilst the security analyses would be incorporated in scanning for susceptibilities and offer solutions. In this case, the fresh elements’ budget would be advanced compared to only utilizing the intrusion detection structures. The cost of investment, even though high, is justified with the rapid development of cracking techniques and tools.

Protocol for Streaming Services

Regarding protocol for streaming services, the commonly recognized streaming service conventions include the Real-Time Streaming Protocol (RTSP), Real-Time Transport Protocol (RTP), and the Real-Time Transport Control Protocol (RTCP).  Virtually every examined streaming service corporation was integrating Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) as the chosen transmitting frequencies. Moreover, Real-Time Streaming Protocol (RTSP) deploys the TCP to enhance consistency in HTTP distribution, communication with the server, and applications (Ozer,2012). Characteristically, content is not distributed over an RTSP link, and the Real-Time Protocol (RTP) is deployed to transfer and distribute audio and video information. In cases where high packet deficit is predominant, TCP is the most suitable protocol utilized in delivering information.

Figure 1: Illustrating the process of Streaming.

With the defined protocols in mind, it is vital to understand that the susceptibilities might be attributed to software deficits, physical accessibility to important ports and components, poorly executed firewalls (Letzgro, 2016).  The protocols incorporated contribute to HTTP delivery, communication with the server, and communication between different software applications. This signifies that rogue software and applications may be mounted, creating space for spasms. Similarly, genuine software that is not immediately improved with up-to-date solutions may establish fault points (Howson, 2017). Moreover, unlimited physical accessibility to apparatus, such as streaming and connection servers, is likely to aid malicious persons in introducing malware and additional attacking elements. At the same time, the utilization of poorly configured firewalls can be ineffectual.

The overall liabilities attributed to streaming protocols may be addressed by executing security controls and similarly risk evaluation reports. In this case, the threat will not be transmitted to the acquiring corporation, and the recognized liabilities and threat would not generate apprehensions that would cause the merger cancellation. It is vital to understand that system administrators, firewall suites, Intrusion detections structure, and instantaneous traffic analysis tools are essential investments.  The returns on these investments may be accumulated after the unification, and they would surpass the investment costs at the start.

Merged Infrastructure

The merged infrastructure may deploy a cloud situation with some hardware and software being disseminated while others are being run self-sufficiently. Nonetheless, several servers, networks, and software that structure the attained IT infrastructure may remain in use before the eventual merging of the combined IT elements consisting of service delivery components. It is essential for project leaders, network engineers, and security managers to acquire a copy of the functioning index files and amalgamate the procured corporation’s guidelines with the strategies of the parent corporation. The policy differences may require a streamline regarding the domain and maintenance configuration through the acquiring business’s policies and procedures.  This signifies that the acquired corporation’s data security and data privacy guidelines, principles and processes, appraisal reports, outcomes of susceptibility scans, and technical certification will be reassessed to conform with those of the procured corporation.

Secondly, the merged infrastructure should guarantee that the new infrastructure offers various elements to ensure a smooth merger.  They include data security, adhering to compliance guidelines, employing incident management and reporting apparatuses, delivering user cognizance programs, and supporting risk management through the business’ arrangements. For example, every connector into the principal company using Active Directory Federation Services or connectivity set up for databanks and software should be improved with administrative, technical, and logical regulators.  It is similarly vital to guarantee that the new IT infrastructure employs established firewall suites to safeguard the installed server and improve server safety by placing its web server in the DMZ.

Wireless and BYOD Policies

Today, most computer users are incorporating dominant mobile devices to interrelate with several service providers over wireless network links. It is normal to obtain streaming service providers letting personnel utilize their devices at the workstation and clienteles that typically pursue streaming services through their mobile devices. Foremost, the gadgets possess significant threats, for instance, operating system shortfalls, inappropriate and misconfigured software, and additional security apprehensions. Furthermore, users are likely to pose security liabilities, for instance, deliberate or inadvertent exposure to threats and lack of responsiveness.

There are numerous positive characteristics to wireless networks and the BYOD approach. The undesirable aspects viewed as risks are to be annulled through the implementation of policies and security guidelines. The first part would entail bearing in mind the organizational and technical approaches, which may comprise anti-malicious malware, ethical controls, and cryptography. Wired Equivalency Privacy (WEP) and Wi-Fi Protected Access (WPA) standards ought to be integrated to safeguard information being transmitted and stored. Secondly, anti-virus programs and scanners ought to be employed to avert malware and additional damaging websites and applications.

Users need to undergo sufficient mobile device safety cognizance to limit inadvertent security risks and enhance security risk concealment, containment, and reporting abilities. Thirdly, consumers are similarly needed to safeguard their gadgets, strong passcodes, and additional physical security elements. Finally, the last wireless and BYOD security requirement should be implemented by the organization by deploying the mobile device management module and physical protection of wireless network equipment. Mobile device management modules include remote device security management and access control, and device and activity monitoring. Ultimately, the last wireless and BYOD security prerequisite should be employed by the business through the disposition of mobile device managing modules and physical guard of wireless system equipment. Mobile device management modules comprise remote device security controlling and access control along with device and activity observing.

Data Protection Plan

The emphasis here is to guarantee data safety delivered at diverse levels of the acquired corporations’ structural design. It similarly consists of characteristics that would supplement the safety, processes, and guidelines and improve safety. The data safety mechanism should include execution undertakings that would be fundamental for safety and defense procedures such as disk encryption (Vrontis Weber & Yedidia Tarba, 2012). Additional tools incorporated could be BitLocker and platform identity sources and data mapping, encryption, data loss preclusion techniques, informing, and strengthening. Likewise, the Trusted Platform Module (TPM) comprises elements and drivers identified to aid in improving verification and complementing the authorization structures. Full disk encryption is a Windows OS method that is identified to assist in protecting absconded information. It is assumed to work with the TPM chip to guarantee encryption. According to Carnaghan (2015) If the TPM cannot authenticate the device’s state, it may not offer the keys to decrypt the information . Therefore, if the storage is detached, then the information may not be read, as the key is still existent in the TPM Chip. This offers extra safety in guaranteeing the information secured.

Supply Chain Risks

Acquisition of a new company would signify that the supply chain is likewise merged, and the best mode to guarantee that there are no threats that result from the supply chain amalgamate is implementing good governance (Burt et al.,2013).  Supply chain risks are risks and liabilities that a company faces because of third-party engagement. To counteract this, better management is a vital tool. Better governance should compel the corporation to advance the course of selection and employment Wigmore (2015). It ought to also analyze past occurrences to demonstrate an evaluation of the desired service provider and its safety system. Every service provider must offer a security stance and policies to evaluate safety willingness and analyze risk management approaches.

Vulnerability Management Program

Generating a vulnerability management program is extremely significant as it aids in ascertaining the liabilities that might arise from an amalgamated IT infrastructure and emerging risks. To generate a vulnerability management program, one needs to prioritize every asset and plan the areas that require being regularly evaluated (National Institute of Standards and Technology, 2013, July). Moreover, guidelines and processes, individuals, and additional vital elements of the complete IT infrastructure need to be assessed for any voids or deficits.   A suitable susceptibility management program ought to accomplish gap analysis to ascertain deficiencies in security posture, incorporation strategy, and policy structures.

Educating Users

Security awareness preparation and education programs are the critical links to all-inclusive cybersecurity, mainly where unifications and procurement are on track. Foremost, users are hackers to dupe users into revealing sensitive information mostly utilize the vulnerable line of cybersecurity as an inadvertent unjust pronouncement. For instance, log-in information.  To guarantee users are security cognizant, it is vital to inform them on the variances arising from the changing strategies, the most appropriate policy, compliance principles that should be maintained, and the code of conduct anticipated.  It is similarly imperative to inform users on how cyber-attacks are proliferated and ways of detecting, containing, and preventing spiteful undertakings and reporting. Additional notable characteristics that personnel must be declared include generating robust passwords, defensive methods, and personal-oriented security approaches.

Conclusion

A strong cybersecurity strategy and structure are vital for an effective merger, and it is critical to analyze the procurement of the target. By integrating cybersecurity into Acquisition, the gap analysis would aid in delineating the level of security of the target firm and aid in estimating the cost of alterations that would need to be made to bring it to acquiring corporations’ principles. The due diligence procedure in cybersecurity aids in ascertaining the liabilities and threats and uncover any that may require to be reorganized before finalizing the deal.

 

 

References

Burt, D., Nicholas, P., Sullivan, K., & Scoles, T. (2013). Cybersecurity Risk Paradox. Microsoft SIR.

Carnaghan, I. (2015, October 25). Operating systems security: Protection measures analysis [Blog post]. Retrieved from https://www.carnaghan.com/2015/10/operating-systems-security-protection-measures-analysis/

Hart, C., Jin, D. Y., & Feenberg, A. (2014). The insecurity of innovation: A critical analysis of cybersecurity in the United States. International Journal of Communication.

Howson, P. (2017). Due Diligence: The Critical Stage in Mergers and Acquisitions. London: Taylor and Francis.

Indeed. (2020). Neteork Administrators Salary. Indeed. https://www.indeed.com/career/network-administrator/salaries

Kaspersky. (2020). Kaspersky Business Security. Kaspersky.Com. https://www.kaspersky.com/small-to-medium-business-security

Letzgro. (2016, August). How to Sort Through the Variety of Streaming Protocols. Retrieved from https://letzgro.net/blog/the-variety-of-streaming-protocols/

Merchant Industry. (2019, April). Payment Card Industry (PCI) Compliance. Retrieved from https://www.merchantindustry.com/pci-compliance/

Misata, K. K. (2016). Gap analysis: Identifying the current state of information security within organizations working with victims of violence.

National Institute of Standards and Technology. (2013, July). Creating a Patch and Vulnerability Management Program. Retrieved from http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-40r3.pdf

Ozer, J. (2012, August 22). What is a streaming media protocol? Retrieved from http://www.streamingmedia.com/Articles/Editorial/What-Is-…/What-Is-a-Streaming-Media-Protocol-84496.aspx

Sell, C. (2015, January). How To Conduct An Information Security Gap Analysis. Retrieved from https://www.cio.com/article/2876708/how-to-conduct-an-information-security-gap-analysis.html

Sisco, M. (2015). Acquisition: IT due diligence. Columbia, Tenn.: MDE Enterprises

Skoudis. (2017, June). Mergers and acquisitions: Building up security after an M&A. Retrieved from https://searchsecurity.techtarget.com/tip/Mergers-and-acquisitions-Building-up-security-after-an-MA

Vrontis, D., Weber, Y., & Yedidia Tarba, S. (2012). Mergers and acquisitions process: The use of corporate culture analysis. Cross Cultural Management: An International Journal. https://doi.org/10.1108/13527601211247053

Wigmore, I. (2015). Supply chain. Retrieved from http://whatis.techtarget.com/definition/supply-chai