Lesson 6.23: Capstone: security due diligence for an acquisition
Northwind plans to buy Kestrel Logistics. When you buy a company, you buy its breaches too: the ones that happened, and the ones waiting in its exposed systems. Security due diligence checks what the target claims against evidence and outside view, so the deal team can set conditions, adjust the price or protect itself in the contract. In the lab you review Kestrel's questionnaire, find claims without evidence, scan results that contradict them, an ISO certificate that covers less than it seems and an unresolved ransomware incident, then write the day-1 conditions.
30 min
You will learn to
- Test self-reported answers against evidence
- Use an external view to contradict or confirm claims
- Read the scope of a certification
- Weigh past incidents and their root-cause actions
- Write conditions the deal team can use
← Capstone: the quarterly security report to the board · All lessons · Package management on Debian and Ubuntu: apt →