Retooling Factory Security for the Digital Age

Dealing with Cyber Risk

As Marriott learned after buying Starwood, an acquisition can introduce cybersecurity risks and liabilities for a buyer. The outdated security systems and lack of formal risk-management programs at many midsize manufacturers mean acquirers should tread carefully.

Among the concerns that need to be considered during an M&A transaction is the possibility of a post-sale data breach, Hermann says.

“I guess the worst thing that could happen is after closing, a buyer discovers a data breach you didn’t tell them about and then, all of a sudden, you’re on the hook to give them back a big chunk of the purchase price for an indemnification,” she says.

Despite the threats posed to businesses, Dauphinais says cybersecurity does not receive as much focus as it should during M&A.

“I think there’s a lack of understanding of what the risks really are,” he says. “You could have a ransomware event and that could be just as impactful, if not more damaging, than a couple quarters of missed financial projections.”

While inadequate cybersecurity protocols alone will rarely sink a deal to acquire a company, they will potentially impact the purchase price or terms.

“If you feel a company has been lax in any area of preparation—their financial statements aren’t as robust as they could be, or they don’t have cyber insurance or they don’t have good benefits plans—all those things weigh into the price of the deal,” Hermann says.

A company that is the target of a purchase should be able to demonstrate good governance overall.

“Make sure you have good policies in place,” Hermann says. “Make sure your employees are being trained and you have a good data protection policy on the website. Make sure you know what data you collect, how you store it and who has access to it. Change your passwords every 90 days.”

One way for a company to identify its cybersecurity weaknesses is to hire an outside firm to do an assessment.

“If you really want to put your best foot forward, hire a third-party investigation to do a phishing test or a penetration test,” Hermann says.

Even if a gap is revealed, “at least you’d look like you’re aware of it,” she adds.

Paul Cotter, senior security architect for West Monroe Partners, says companies that discover security weaknesses should develop plans for addressing them.

“What we generally advise is that if you’re looking to sell a company, you want to make sure that if you are aware of a gap, you demonstrate that you know about it and that you have a plan to address it, either short-term or long-term,” Cotter says. “Or be ready to establish that the gap is not as critical as perhaps some other issues.”

For a company that’s looking to sell and has been compromised, Wojcinski wants to see documentation of what they’ve done to correct the issue.

“If you got cracked wide open, and you had a compromise, I’d want to see a follow-up to show me that it’s been fixed,” he says.

Closing the Gaps

When working with a buyer, Wojcinski says his job is to predict any post-close, unexpected costs. One area that can be costly is ensuring software and servers are up to date with the latest patches.

He cites Windows 7, which is no longer supported by Microsoft, as an example.

“You could have highly important manufacturing systems that are dependent on vulnerable software that can’t be patched,” he says. “A buyer should know that they are buying vulnerable infrastructure that can’t be updated. And they need to think through, ‘Am I prepared to have this machine go offline in an attack and not be able to recover it?’”

Wojcinski and other experts say companies should consider purchasing cybersecurity policies and know their limits and exclusions. He notes these policies can be tailored to the particular risks a company faces.

Another area to look at is employee training.

“The best hackers don’t hack computers. They hack people,” Wojcinski says. “It is way easier for me to trick you into giving me your password so I can come back into your system using your credentials rather than figure out how to circumvent the technical safeguards that are already there.”

He adds that training employees to recognize security threats isn’t enough; companies must promote a culture that encourages them to ask questions.

A common security threat is a hacker who sends an email pretending to be a trusted person within a company.

“I want to know if there is a culture in the company where it’s OK for an employee to question one of those messages and ask, ‘Is the director of finance really asking me to do this?’” Wojcinski says.

“Holes that didn’t Exist Before”

Another area where a prospective buyer should focus is on the products a company sells, particularly as artificial intelligence, internet-enabled devices and other technologies become more prevalent.

“I worry about whether a company I’m buying has caused a third party to have a problem,” Hermann says. “If I’m buying a company that is selling iPhone speakers but is not designing them appropriately to not be hacked, then that could result in a class-action lawsuit.”

During the due diligence phase of a potential acquisition or merger, Hermann says bankers and lawyers hired as advisers should be asking a lot of questions about cybersecurity, as well as other areas.

She wants to understand any potential liabilities a company’s products may have.

“I’m going to be asking a lot of questions about what is referred to as ‘security by design,’” she says. “How is the company designing their products? Are the products they are putting out there safe or are they vulnerable to an attack?”

Events that are well beyond a company’s control— the COVID-19 pandemic, for instance— also can affect cybersecurity.

Cotter says employers rushed during the pandemic to enable employees to work at home, which has created security gaps.