Consultative, Advisory, Investigative and Planning provided:
Appraisals and valuations | Inspection, exploration, survey, testing (including collection & analysis of samples/data) | Compliance with regulatory requirements | Risk assessments
Reporting and recommendations.
Context
Vernetzen was engaged by one of Australia's largest engineering companies, during one of their acquisitions, as part of their due-diligence.
Cyber security risk assessments and network asset cataloguing were conducted using Vernetzen’s ZenEye tool.
Scope
In the world of mergers & acquisitions it is common place for one or both parties to conduct due diligence on the combined assets. With the increasing importance of OT Networks, including remotely delivered services (often by third-parties) — the robustness and security of the merged entity is gaining attention. The case in question involved a merger of multiple companies.
Issues and Resolutions
Assessing the quantity and state of operational assets within these companies proved difficult due to widespread use of mobile devices.
Vernetzen was able to adapt their ZenEye tool to quickly and accurately take inventory of all operational assets.
At the commencement of the engagement, the client was unaware of any data loss within their combined assets.
Vernetzen’s findings highlighted several key areas which did not comply with IT and OT network standards ultimately leading to poor security and data loss.
With the discovery of security breaches and data losses, Vernetzen quickly refocussed from a pure assessment exercise to addressing the security breaches directly.
As an organisation that prides itself on its practical capabilities – Vernetzen was able to pivot quickly to the new focus for the project.
Outcomes
Vernetzen quickly identified both the existence of malware and constant phishing attempts. To prevent further breaches Vernetzen conducted onsite in-depth cybersecurity seminars based on best practices and industry Cybersecurity standards.
Conclusions
Merging of two (or more) businesses presents many challenges. The composition and condition of operational assets is key to understanding the value of the combined assets and its ability to inter-operate.
Traditionally OT networks have been kept separate from IT networks and the internet. With OT and IT convergence it is important to understand the differences between them and how they can affect each other. As OT networks become widely connected to external sources they become more vulnerable to malicious attack. So when connecting IT and OT networks together it is important to ensure the security of OT endpoints as these can offer easy access to an otherwise secure IT network.