If Dow Chemical Co. is at the heart of this mid-Michigan city, so, too, is Midland at the heart of the chemical giant.

Dow’s roots reach back to 1897, after Herbert H. Dow discovered a new way to extract the element bromine — then a useful ingredient in medicine and photographic materials — from brine located in wells around Midland.

“That was the beginning of Midland’s future. It grew in ways people could never predict,” says Gary Skory, director of the Midland County Historical Society.

Today Midland is the global headquarters of Dow Chemical, now a Fortune 500 company that employs 49,500 people worldwide. Dow manufactures products from plastics to paint preservatives and basic chemicals essential to thousands of products made throughout the U.S. and beyond.

So when Dow (NYSE: DOW) and rival DuPont Co. (NYSE:DD) in December announced their planned merger and the creation of the newly dubbed DowDuPont, Midland residents anxiously awaited word of their city’s largest employer.

While the long-term impact of the merger remains unclear, Dow has repeatedly assured local, regional and state officials its global headquarters will remain in this city of 42,000.

“Dow’s commitment to the Great Lakes Bay Region remains strong,” says Dow spokeswoman Rachelle Schikorra.

The company had $230 million worth of capital investments in its Midland operations in 2014, according to city officials. Its annual sales in 2015 were nearly $49 billion.

Since the company’s inception, Herbert H. Dow’s descendents have been a driving force here. Visitors to Midland would be hard-pressed today to miss Dow’s pervasive civic presence – and its red diamond-shaped logo.

Beyond the sprawling chemical plants, research laboratories and manufacturing facilities, the softer side of Dow’s largesse is evident. A minor league baseball stadium sits on land donated by Dow and named for the chemical and industrial titan. The family name also adorns the city’s library, a science and art museum and botanical gardens.

Dow’s multimillion-dollar philanthropy not only boosts the quality of life for residents, it also helps attract a global workforce to this quaint city two hours north of Detroit.

Dow has come a long way in its transition from a chemical commodity company to an innovation-centric science company, says Andrew N. Liveris, Dow’s chairman and CEO. The company’s growth over the last century, he says, stems from the ethos of its founder and Midwestern community-mindedness.

“If you think of the basis of a community like Midland or the Great Lakes Bay Region, or for that matter the entire state and entire Midwest, there’s a certain community neighborhood view that we’re all in it together, independent of what we earn, independent of where we’ve come from, independent of our accents.

“That tone is in the DNA of the company,” Liveris told the Midland Daily News in July.

Merger of equals
Dow Chemical’s joining with Delaware-based DuPont would be the largest ever in the chemical industry and would reshape global chemical and agriculture industries. The two companies have a combined market value of about $130 billion.

Subject to regulatory and shareholder approvals, the so-called “merger of equals” is expected to close in the second half of 2016. The new company will be dual-headquartered in Midland and Wilmington, Del., where DuPont is now based.

Both Dow and DuPont shareholders will each own 50 percent of the combined company in a deal estimated to bring $3 billion in cost synergies and $1 billion in growth synergies.

But that’s just the first phase in a two-step merger.

Once complete, the two conglomerates will cease to exist and the newly formed DowDuPont will pursue a tax-free split into a trio of independent, publicly traded companies: an agriculture company with $19 billion in revenue, a material science company with $51 billion in revenue and a specialty products company with $13 billion in revenue.

The splitting of the combined company is expected to occur 18 to 24 months following the merger.

Each of the businesses are said to have a clear focus, an appropriate capital structure, a distinct and compelling investment thesis, scale advantages, and focused investments in innovation to better deliver superior solutions and choices for customers, according to company officials.

“This transaction is a game-changer for our industry and reflects the culmination of a vision we have had for more than a decade to bring together these two powerful innovation and material science leaders,” says Liveris.

Under the terms of the merger, current DuPont CEO Ed Breen will lead advisory committees to spin out the agriculture and specialty products units, while Liveris will lead the material science advisory committee. While the two larger companies remain merged, Liveris is to serve as executive chairman; Breen will be CEO.

When the DowDuPont merger was announced, Dow also said it would become the sole owner of nearby Bay County-based Dow Corning Corp., a joint venture that was formed in 1943 by Dow and Corning Incorporated.

“With Dow and Dow Corning coming together, Dow will extend its participation in consumer solutions and infrastructure solutions segments by increasing Dow’s product offerings in several attractive end-use applications such as building and construction, consumer care and automotive,” Dow said in a statement.

Dow officials declined to go into further detail on the pending merger of the publicly traded company.

In Delaware, officials and residents have been on edge about DuPont’s future since last year when DuPont moved its headquarters out of its downtown Wilmington building that served as its home for 107 years and into a suburban office park.

DuPont and Dow announced in December that the specialty products business coming out of the merger would be headquartered in Delaware.

Wilmington will also be headquarters for a combined agriculture spinoff. The total combined revenue of the agriculture and specialty products businesses will be greater than the revenue of DuPont today.

The Wilmington site was selected in large part because of its close ties to the 214-year old DuPont company and deep roots in product discovery.

Wilmington, where DuPont now has its corporate headquarters, will also be a base for the agriculture business’ chief executive and other key corporate support positions. The agriculture company – which will feature DuPont in its name – will also have global business centers in Johnston, Iowa, and Indianapolis, Ind., which is home to Dow Agrosciences.

“Our deep presence in Iowa and Indiana will continue the close ties to our customer base and the broader agriculture community, while leveraging the existing corporate infrastructure and expertise we have in Delaware – DuPont’s home for more than 200 years,” Breen says.

Officials reiterated the material science spinoff, “a low cost, innovation-driven leader” according to company statements, will have its headquarters in Midland and will be named Dow. It will serve customers in high growth segments and include the core of Dow Chemical’s current businesses, including performance plastics, performance materials and chemicals, infrastructure solutions, consumer care and automotive solutions (excluding the Dow electronic materials business) operating segments, as well as DuPont’s performance materials segment.

“This efficient structure takes full advantage of the unique expertise and resources that exist in each location, enabling us to deliver the long-term opportunity for the leading global agriculture company we intend to create,” Breen says.

Dow will bring about $45 billion in net sales to the new company, with DuPont bringing about $6 billion, officials previously stated. Combined, they will form the No. 2 player in the world in this market, behind BASF.
Reassuring anxious shareholders is another important byproduct of the DowDuPont merger.

Under the terms of the merger, Dow shareholders will receive a fixed exchange ratio of 1.00 share of DowDuPont for each Dow share, and DuPont shareholders will receive a fixed exchange ratio of 1.282 shares in DowDuPont for each DuPont share.

“When I look at DuPont and Dow, I see businesses that fit together like hand in glove,” Breen says. “The strategic nature of what we could pull off is incredible. To me, it checks all the boxes of a great deal and a way to create value for our shareholders.”

Dow shareholders were returned $2.7 billion through paid dividends and share repurchases from the fourth quarter of 2015. In 2015, Dow returned $4.6 billion to shareholders.

The combined company would have about $90 billion in total revenue, based on 2014 numbers, and products ranging from corn seeds to Kevlar fiber to foam chemicals used in sneaker soles.

Both are contending with sinking commodity prices and a strengthening U.S. dollar that have put pressure on the revenue side.

Each has sought separately in recent years to reinvent itself as a maker of more-profitable products while facing pressure from major investors agitating for faster, bolder moves.

Changing of the guard
After orchestrating the $130 billion merger with rival DuPont, Liveris announced in February his plans to retire by mid-2017 when the three-way DowDuPont split is ready.

The Australian engineer, a 40-year Dow veteran who has served as CEO since 2004, Liveris has become one of the world’s best known CEOs, delivering keynotes at the Davos World Economic Forum, and serving on an advisory panel to U.S. President Barack Obama.

His career has spanned roles in manufacturing, engineering, sales, marketing, and business and general management around the world. As Dow’s CEO, Liveris has led the company’s transformation from a cyclical chemicals manufacturing company into a novel enterprise – one powered by science, driven by innovation and delivering solutions to the world.

Dow announced in in February that Jim Fitterling was appointed president and chief operating officer of Dow.

Fitterling, who has worked with Dow for 32 years, previously held the position of vice chairman and chief operating officer.

“Jim has been a tremendous leader for Dow for more than three decades and has spent his entire career at our great company,” Liveris says. “His appointment to the position of president is well deserved and a reflection of his abilities and commitment to our company.

Fitterling will play a central role in helping drive the successful completion of the proposed merger and subsequent establishment of its three independent public companies.

Committed to Midland
Fitterling says Dow has made physical moves already this year to show its commitment to Midland, referring to plans for a new 150,000-square-foot building to serve as the centerpiece of Dow’s corporate campus here.

“A lot of what we’re doing here to build new facilities is to drive some efficiency,” he says. “It’s not just replacing an old building, but it’s trying to create a new environment, a new efficient space and a new way to work for the new company.”

Dow’s 150-acre global headquarters includes buildings that house several of Dow’s corporate, business and functional offices. The campus also includes a video production studio, employee-training center and wellness/fitness center.

Local, regional and state leaders say they are pleased that Dow plans to keep Midland as its home.

“As changes in Dow’s structure occur during the coming months and years that will shape the merger of these two storied companies, we’ll work with leaders to emphasize the value of Michigan’s many resources, especially its skilled people, to support its efforts in our state,” says Gov. Rick Snyder.

U.S. Rep. John Moolenaar, (R-Midland), says he’s followed the merger talks with great interest.

“It is my hope that the new DowDuPont will continue its commitment to innovation and have a positive economic impact in the Midland community, the Great Lakes Bay Region and all of Michigan,” Moolenaar says.

Dow spokeswoman Schikorra says growth is the expectation for the material science business, one that comes from “combining low-cost integration and innovation with expanded customer offerings in key growth sectors.”

Matthew Felan, president and CEO of the Great Lakes Bay Regional Alliance, says he appreciates Dow’s continued transparencies and commitment to the region.

“In the long-term, this merger will allow Dow to grow in the manner they need to in our region,” Felan says.

In the meantime, the Great Lakes Bay Region is on a mission to promote science, technology, engineering and mathematics (STEM) to make the local workforce more attractive to employers.

“Dow is a great partner in helping us build the workforce of tomorrow, not only for existing employers, but to help us recruit new companies to the Great Lakes Bay Region,” Felan says.

And Dow will be at the heart of it all, just as it has for more than a century.

“I hope that people will look to the future and see how positive (this merger) is for Midland, for the Great Lakes Bay Region and for the new Dow, essentially,” Fitterling says. “(It) is a much more powerful innovation and science machine, a bigger technology provider, still globally very, very strong and committed to this region. People need to see the positive of that and see where we’re going.”

It was Thursday, 3:55 p.m. John Jones just remembered it was his night to make dinner. With just a few minutes to burn before his next meeting, followed by the rush hour slog and his son’s soccer practice, there was not much time to get a plan together. Jones quickly typed the name of his favorite cooking site into his laptop’s browser. Within seconds he found an e-book he could peruse while waiting for his son. He downloaded the cookbook and rushed off to his next meeting.

That night, while the aroma of baked lasagna wafted through Jones’ house, a virus seeped into his company’s network, having hitched a ride in the cookbook file on its way to infecting computers and shutting down critical infrastructure.

While the story is almost entirely fictitious, the scenario is all too real. “We have yet to find a company that had a protocol in place to stop something as trivial as downloading a recipe,” says Scott Montgomery, security practice manager at Grand Rapids-based Open Systems Technologies. “(In this case) the popular antivirus software did not detect (and/or block) the infected file.”

With a seemingly infinite array of targets and pathways into those targets, experts say it is impossible to eliminate all cyber security risks. Instead, companies need to build up their defensive layers, says Phil Bertolini, chief information officer at Oakland County. Something like an onion, hackers may be able to peel away some of the layers, but if too much effort is involved, they will often move on to an easier target.

The most critical defensive layer, say experts, is having a staff of well-trained users. In the story above, the company ended up being the easier target, not because the antivirus software did not catch the virus but because the employee downloaded the cookbook.

The trouble with trust
People have a “tendency to trust,” and hackers use that misguided trust to their advantage, says John Hey, chief operating officer of Trivalent Group in Grand Rapids. While people assume that their favorite cooking website would never provide a bad link or an infected file, legitimate websites may not even know they are serving files that carry malicious code.

And then there’s the scenario of a bank asking for a customer’s account number, with some people assuming the request is legitimate. But hackers routinely impersonate trusted businesses to gain access to money or protected information. “Attackers have become aware that it is often easier to exploit users at the browser and email level, rather than compromising servers,” reports Cisco in its 2015 Annual Security Report.

Whether via so-called “phishing” emails, rogue links, or weak passwords, for every user, hackers have multiple access points into a company’s system. And those access points can be exploited many times over across many different online interactions: social networking, purchasing, emailing, web browsing. For every 10 phishing emails, seven may be obviously rogue, but the other three can “trip you up,” says Hey.

Weak passwords create peep holes through which hackers can access bits of data. Consider how much of a person is revealed through their email conversations—who are they talking to and about what. Combine those bits of data with what is already available through social networking sites, the Internet generally, and the data that can be purchased on the dark web, and a hacker could easily impersonate a legitimate company, someone the user knows, or even the user.

The price tag for trust
The costs of a security breach include diminished reputation, customer turnover, recruitment of new customers, regulatory fees, identity insurance for clients, lost business, downtime, and, possibly, the business itself.

In dollars, those costs average out to $6.5 million for an organization that has been breached, reports the Ponemon Institute in its 2015 Cost of Data Breach Study: United States. The study analyzed the costs incurred by 62 U.S. companies who had experienced a security breach in which protected data had been taken. On average, 29,070 records were breached in each organization at an average cost of $217 per record.

For some companies, the thought of millions of dollars and tens of thousands of client records may seem too large to be relatable. Yet, every organization has data or revenue that can be exploited. “Last year, 60 percent of all targeted attacks struck small- and medium-sized organizations,” according to Symantec’s 2015 Internet Security Threat Report. “These organizations often have fewer resources to invest in security, and many are still not adopting basic best practices like blocking executable files and screensaver email attachments. This puts not only the businesses, but also their business partners, at higher risk.”

If hit by a cyber attack, downtime is the inevitable result. Even a single day of unscheduled downtime threatens the longevity of a company, says Hey. Several years ago, a local manufacturer was hit with a virus that took out two-thirds of its computers, recalls Hey. To get the company back up and running as quickly as possible, Trivalent had 15 people on site, going from computer to computer to isolate the virus and clean the machines in a process that took two days. Without that level of response, the company could have been down for a week, says Hey. And while the outcome was good (the company is still in business and has actually grown), had the outage been longer, the story could have ended badly.

Cyber security is a business issue, not an IT issue
Even if a company recognizes that cyber security is a concern, it may be assuming that it is an IT issue. IT certainly has a significant role to play in terms of the technology aspects of cyber security. However, cyber security is an enterprise-wide risk management issue, according to a report from ISACA, formerly known as the Information Systems Audit and Control Association.

In the report, Cybersecurity: What the Board of Directors Needs to Ask, ISACA says setting the tone for the organization is one of the key responsibilities of board members and executives alike.

Even while making cyber security a company-wide priority, there may yet be an assumption that the IT staff is qualified to assess cyber security weaknesses and respond to attacks. Often, neither is true. “Most organizations are just going to have a basic IT staff,” says OST’s Montgomery. “They may be highly educated, highly experienced people, but, again, the function of IT is usually around maintaining an existing environment.”

Beyond the question of skills, allowing existing IT staff to assess a company’s cyber security presents a conflict of interest, Montgomery asserts. Typically, it is the board of directors or executive level that should be requesting the service. “An IT staff really doesn’t feel the need for me to come in and assess their security. That’s like somebody calling their baby ugly. They don’t get a good benefit out of that. There is a vested interest in the executive team knowing what the risk is.”

Professional help
Professional cyber security experts can be expensive. By some estimates, more than one million cyber security professionals are needed to fill the skills gap that exists in the field and those that have the right skills can demand high salaries. Alternatively, consulting groups, like OST and Trivalent, provide assessment and emergency response services related to cyber security and other IT needs.

When considering how much to spend on cyber security, there are different approaches. J. Wolfgang Goerlich, director of security strategy at CBI, suggests that a company budget 0.2 percent of its annual revenue on cyber security. In addition, he recommends one full-time cyber pro for every 1,000 employees. However, Montgomery says his firm, OST, does not make recommendations on staffing. And Cisco’s security report states that a large number of cyber security staff is not necessarily an indicator of a better security posture.

Waiting until after an attack to seek professional help may not be the best approach, for obvious reasons.

“If you don’t know who to call, you can’t just look it up at the last minute,” warns Montgomery who says he is sometimes booked out two to three months at a stretch. At OST, if they are not already conducting regular assessments on an organization, providing 24/7 emergency assistance isn’t always possible. Indeed, it would be difficult to effectively respond to a breach without knowing the pre-existing security conditions of the organization, says Montgomery.

Assessment
Whether hiring outside help or going it alone, a company that knows its own cyber security posture will be better able to respond to threats. There are many resources available to help companies manage their cyber security concerns, but so much information can be overwhelming, especially when a company lacks in-house expertise.

A “Small Business, Big Threat” assessment, a free service launched by the Small Business Development Center (SBDC) of Michigan last November, includes 31 online questions covering topics like breaches, passwords, mobile security, and physical security, in language that is understandable to a non-technical audience.

Through stories of small business owners, users are provided with examples of how cyber security issues can play out in the real world. The site then generates a score and recommends next steps.

CySAFE for Business is another free assessment, one that was originally developed by Oakland County government for use by public service agencies.

Having been downloaded by more than 400 public agencies in all 50 states, Oakland County then realized that many businesses do not know how to begin assessing their own security and tweaked their government assessment to create one for business.

CySAFE for Business is a far more technical assessment than that of the SBDC, and it takes an entirely different assessment approach. Using three cyber security frameworks (20CC, NIST, and ISO) as its models, it provides 33 key controls. Using a scale of 0 – 5, the user ranks a company’s compliance on each control. Based on the answers, the assessment generates a prioritized list of controls to be addressed. As the company addresses each issue, it can update the chart and see its accomplishments graphed.

Training
Experts agree that for an organization to be secure, its users must be an integral part of the solution. If they are to be the strongest layer of the metaphorical onion, then they cannot be an afterthought. In its security report, Cisco lists five principles for staying secure, three of which focus on human behavior.

Indeed, the second of the five principles warns against making security so complicated that users will either attempt to get around it or be utterly frustrated by it. In short, the security framework must fit the way the company does business. If not, the company will be at greater risk.

Companies are advised to create security policies and parameters that are “transparent and informative” as well as understandable to users. In other words, don’t throw up the proverbial brick wall without explaining why the road is blocked.

Another key: viewing security as a “people problem.”

Security staff need to train users so they can make good decisions and feel empowered to seek timely assistance when they think something is wrong,” says one of the principles laid out by Cisco.

At Oakland County, the first round of annual cyber security training has just been completed, says Bertolini, referring to a series of short videos, each followed by a quiz. For the second round of training, he and his team will use “gamification,” the concept of applying game mechanics and game design techniques to engage and motivate people to achieve their goals.

In this case, users will earn points as they learn best practices. By changing the vehicle of the training, from videos to games, the material keeps employees engaged.

While quizzing users after training will help determine what has been learned or where the training needs to be improved, Bertolini’s team also goes a step further, “phishing” staff by planting rogue links and files where users might be tempted to click. While he would not divulge the results of those phishing expeditions, he did say that his organization did “better than most.” And, perhaps that is enough confirmation that they have built a better onion…than most.