CyberTip: Beware of Social Engineering
A PE Firms’ most critical asset is information. Vulnerabilities exist in the nature and movement of data, and threat actors seek out weaknesses whilst data is static, in transition, or in motion through interconnected entities.
Advanced persistent threats: This method employs a combination of the other methods (discussed below) to evade discovery, whilst gathering information surreptitiously over time. Through this coordinated and subvert approach threat actors are able to precisely target the weakest target personnel in a PE any one connected to a PE Firm.
Social Engineering: This method requires gaining trust of individuals who are the least cybersecurity proficient person in a PE Firm. Thereby, exploiting a PE Firm’s vulnerabilities by riding on weaknesses in the “human perimeter’s” awareness to cyber risk.
Phishing: This method, like social engineering, exploits vulnerabilities through weaknesses in the human perimeter. PE Firms forget that their human perimeter also encompasses their service providers, such as third-party custodians or fund administrators
|Failure to identify due diligence responsibilities. During the diligence stage of the investment, there may be confusion around which party is responsible for surfacing and mitigating potential security issues. Let’s be clear – the responsibility lies with the investor, who must conduct robust diligence to validate and verify the potential investment’s claims. What’s also clear is that the investment target should be an active participant in this phase of the process, providing supporting information about the organization’s security performance over time. By doing so, the target can showcase the organization’s commitment to managing enterprise risk, which should increase enterprise value.|
|Not asking the right questions. For years, cyber diligence consisted of one question: “Have you ever experienced a breach?” For most targets, the answer to that question is a resounding “no,” regardless of the veracity of that statement. Investors need to go beyond this simple question, exploring, for example, the target’s data protection strategy, the types of technologies it has in place to mitigate risk, executive leadership, and employee training, in order to gain a broader understanding.|
|Untapped data. While asking more questions is important, investors must also seek out quantitative, objective security performance information. Historically, the due diligence process has largely relied on qualitative data based on written or in-person interviews with executives and board members, which frequently produces subjective, emotionally-driven results. When evaluating the potential risk an organization may inherit through an investment, it’s best to avoid gut feelings and focus on the facts. While there is value to hearing directly from executives, qualitative analysis should be supplemented with objective, straightforward measurements of security successes and challenges throughout the period. Security ratings provide significant, relevant insight here.|
|Security monitoring. Cybersecurity is dynamic and things can change quickly. Investors often assess the status of an investment’s cybersecurity environment at the beginning of the relationship and fail to monitor the environment throughout the investment period. Failing to continuously monitor the security environment leads to a lack of visibility into risk and potential threats. Just as sales teams report on leads and revenue quarterly, cybersecurity teams should monitor and report on the state of the organization’s security strategy to interested parties on an ongoing basis|
|Lack of business context. More often than not, those driving the due diligence processes are not cybersecurity professionals, which means that they need cybersecurity metrics to be contextualized against potential business impact. For example, it is not enough to share that one million records were exposed in a data breach; investors also need to know the losses the business incurred as a result. Investors should be sure to ask questions that frame these metrics within the context of business impact, such as, “How will this impact stock price, revenue, and our brand’s reputation?”|
The U.S. Securities and Exchange Commission (the “SEC,” or the “Commission”) has in recent years demanded greater transparency from public companies in how they identify, measure, and manage cyber-risk.Read more