In this lesson,
we will learn
about the Organizational Change Attack Surface.
The Organizational Change Attack Surface,
refers to vulnerabilities,
introduced during periods of transition.
Organizational changes attack surface concepts,
include staffing changes, mergers, acquisitions
and divestitures.
Staffing changes like the onboarding
or offboarding of employees can lead to gaps
in access control if accounts are not properly managed.
Next, mergers and acquisitions,
involve the consolidation of companies or assets,
through various types of financial transactions
where one company either merges with or acquires another.
Conversely,
a divestiture is the process of a company selling
or separating a portion of its business,
assets or subsidiaries.
Let's learn more about staffing, changes,
mergers, acquisitions and divestitures.
First, we have staffing changes.
Staffing changes refer to the addition
or departure of employees within an organization.
During such transitions,
there are inherent security risks,
particularly around account management.
Without careful management departing employees,
may leave behind orphaned accounts
that retain system access
or new employees may receive excessive permissions
that allow them to access sensitive data,
they don't need for their role.
This can create security gaps
as unmonitored or misconfigured accounts
are prime targets for attackers
who would like to exploit them for unauthorized access.
In enterprise networks,
staffing changes are particularly relevant,
because each transition could disrupt access control
and data integrity.
For example,
if an employee leaves the company
but their accounts remain active,
these orphaned accounts could be used by a malicious actor
to gain access to sensitive resources undetected.
So, to mitigate risks from staffing changes,
organizations should implement automated identity
and access management solutions,
like Okta or Azure Active Directory.
With these tools,
an organization can streamline their onboarding
or offboarding process, enforce access control policies,
and quickly deactivate accounts when employees leave,
reducing the chance of unauthorized access.
Second, we have mergers.
Mergers involve the integration of two companies
into a single entity,
combining their networks, systems and data.
This integration introduces security risks
as different security protocols
and practices must be aligned
and systems must be evaluated for vulnerabilities
that could compromise the newly formed network.
During mergers,
the rush to connect and consolidate systems
can sometimes lead to oversight,
leading previously secure resources vulnerable.
Mergers are relevant to enterprise networks,
because combining infrastructures
without thorough security alignment
can result in unauthorized access to sensitive data.
For instance, if a newly merged company,
doesn't properly manage access controls,
employees from one company may inadvertently gain access
to confidential resources from the other.
So, to mitigate these risks,
organizations should perform a comprehensive security audit
and implement network segmentation controls,
like Cisco's identity services engine
or firewalls to control access during the merger.
Additionally, merging companies,
should also use security information and event management
or SIEM tools to monitor for abnormal activity in real time,
looking for unusual login locations,
access attempts outside of normal working hours,
excessive data transfers and any access to systems
or data by users who typically wouldn't need it.
Third, we have acquisitions.
Acquisitions involve one organization,
taking control of another,
often requiring the integration of systems,
data and processes.
Like mergers, acquisitions, present security risks
as the acquired organization's infrastructure,
may have vulnerabilities or mis-configurations
that attackers could exploit,
once the systems are integrated.
These risks are heightened
if the acquired company's security standards differ
from those of the acquiring organization,
which can create gaps in the combined networks defense.
Enterprise networks face unique challenges in acquisitions,
because integrating systems quickly
can make it easy to overlook access control discrepancies.
For example, an acquired company's network,
may include outdated services that were previously internal,
but now exposed the entire network
to potential vulnerabilities.
So, to reduce these risks,
the acquiring organization,
should conduct a security assessment
of the acquired systems,
maybe using tools like Rapid7 or Nessus
to scan for vulnerabilities before completing the merger.
Additionally, oncoming access controls,
should be carefully reviewed and adjusted,
using identity and access management tools
to ensure only necessary personnel,
have access to the acquired systems in the merged network.
Fourth and last, we have divestitures.
Divestitures involve a company selling
or separating a portion of its business, assets
or subsidiaries,
which can introduce vulnerabilities as data
and resources are divided.
This separation process can expose sensitive data
or leave IT assets insufficiently protected
if security controls aren't carefully maintained
and resources aren't decommissioned properly.
Divestitures require extensive planning
to avoid data leakage
and ensure that separated resources
are securely transferred or disposed of.
In an enterprise network, divestitures are relevant,
because systems that were previously integrated,
must now be disentangled without compromising security.
For example,
if an organization fails
to properly decommission shared servers,
during a divestiture,
the separated entity may still have access
to sensitive data.
So, to mitigate these risks,
organizations should use data loss prevention tools,
like Symantec Data Loss Prevention,
or McAfee Total Protection
to monitor data transfers and prevent unauthorized access.
Additionally,
IT teams should perform a security audit
to confirm that all shared resources have been reconfigured
or decommissioned appropriately,
ensuring data integrity post-divestiture.
So remember,
the organizational change attack surface,
refers to security vulnerabilities
that emerge during times of transition,
such as staffing changes, mergers, acquisitions
and divestitures.
Staffing changes can create risks
when employee accounts are not properly managed,
leading gaps in access control.
Mergers involve integrating two companies networks,
and systems into one,
often creating vulnerabilities
if security practices aren't aligned.
Acquisitions where one organization takes control of another
introduce similar risks as differing security standards
and configurations in the acquired network
may expose vulnerabilities.
Finally, divestitures where a company separates
or sells part of its business can expose sensitive data
if assets are not secured or decommission properly.
Each of these transitions demands careful planning
and security measures to protect data integrity
and minimize exposure to unauthorized access.
By using tools like Identity and Access Management
or IAM systems security information and event management
or SIEM platforms and Data Loss Prevention or DLP,
organizations can better secure their network,
during these significant operational change times.