巫山师培中心师范教育教师教学常规.ppt

Information Security in Mergers Acquisitions Introduction Chris Conacher BAE Systems BAE Systems, Airbus Intel Corporation KPMG LLP Black Hat Consulting chrisc@ Key Learning Objectives Provide an understanding of critical Information Security risks within the Mergers Acquisitions (MA) process Provide an understanding of the need for Information Security in managing those risks Provide an approach that identifies key actions at various stages within the MA process General Learning Objectives Specific IS risks as they relate to MA: Risk to your and the target organizations Risk in relation to phases of the MA process Role of IS in managing risks: Preparation and development required Key questions IS should answer Key actions at key stages of the MA process The different Phases in the MA process Relevance Sudden Change Profile Threat Model Form Sudden Impact Resources Mergers Acquisitions Spin Offs / Ventures / New Business Initiatives Business Drivers Confidentiality Speed Business as usual Zero Impact Informed Business Decision on Risk Risk Threat in MA Special Interest Groups – gain from MA Financial Criminals Competitors Acquisition / Merger Company Disgruntled Employees General Interest Groups – gain from impact Everyone Else Script Kiddies Hackers / Crackers Hacktivists Terrorists Spies Your interest gets attacker’s interest Risk Publicity and Profile Known Target due to impact on: Resources Technologies Infrastructure Confusion Absorption of “Soft Target” Disgruntled Employees One of the few times an Organization is really “shaken up” Risk to You Change in threat model Change in risk model Impacting resources Absorbing unknown Disgruntled employees Creating new attack vectors Creating window of opportunity Business drivers can force this upon you very quickly Are you equipped for change? Major overnight change in Threat Model Multi-site / Global Foreign Nationals Different technologies Different skill requirements Upgrade of data classification Ownership of