The Overlooked Challenge of Data Security in an M&A

Mergers and acquisitions in the financial industry have come fast and furious over the last couple months, each one raising multiple challenges for the companies involved. A vital, but easily overlooked one, is data security. When companies are in the midst of an M&A, how do they protect their customers' confidential data?"There are challenges around understanding the data an organization is acquiring when one bank buys another. Often there is a large customer database, like Wachovia [which was acquired by Wells Fargo] had. But companies must also find out where else copies of data are stored," says Dave Meizlik, senior product marketing manager, Websense.

Organizations should ask themselves whether people have copies of data on their desktops, and whether these people are still with the company. They should also look at what they have done with their desktops or laptops, or the files they had on them, Meizlik suggests.

Companies undergoing an M&A need to have the ability to scan their network and laptops and identify where the data is stored. "They need to have the ability to automatically remove the data, or put controls to limit what someone can do with it such as download it to an iPod," he says.

Organizations should also passively monitor their business communications. During an M&A, a lot of confidential data exchanges hands between law firms, auditors, acquired and acquiring companies. "You need to make sure relevant communications aren't being leaked out to the press or others in the company," Meizlik says.

If a list of the employees who are going to be laid off after an M&A is leaked out, there will be ramifications. "So you need to passively monitor communications," he adds.

As critical data exchanges hands, organizations must also ensure communications are secure. "There are many reasons why you'd want to send M&A details to a partner at a law firm. "But you don't want them sent to a competitor or posted to a financial chat board," he says.

The core to a robust data loss prevention (DLP) system is to understand the data. Websense says its DLP solution has content intelligence to identify what is confidential from what is not. "We can tell if it's a grocery list or a customer list, whether it's a recipe or source code," says Meizlik, who writes a regular blog on data loss prevention.

"That will tell you what your assets are and will help you set up policy controls. You can then block communications or leverage encryption technologies, and monitor who is allowed to open a particular file," he adds.M&As in the financial industry have come fast and furious over the last couple months, each one raising multiple challenges for the companies involved. A vital, but easily overlooked one, is data security. When companies are in the midst of an M&A, how do they protect their customers' confidential data? Melanie Rodier has worked as a print and broadcast journalist for over 10 years, covering business and finance, general news, and film trade news. Prior to joining Wall Street & Technology in April 2007, Melanie lived in Paris, where she worked for the International Herald ... View Full Bio