The 3 First Steps Towards Bolstering a Law Firm’s Cybersecurity Posture
Law firms may not be the first type of business that comes to mind as a hot target for cybercriminals, but because of the hidden supply of valuable information they deal with, they are becoming more popular for the wrong reasons. Clients entrust a firm with their private information and assume that it will be kept safe. In a PwC report entitled, Safeguarding Your Firm From Cyber Attacks, they note, “Privacy and confidentiality are bedrock qualities for law firms. The theft of client information could be devastating to a firm’s reputation, which is their most important asset,” (PwC, 2012).
As the number of attacks against law firms and costs associated with breaches increase, it’s time to take a serious look at your cybersecurity strategic plan. Is your firm prepared to withstand an attack? If you haven’t begun any initiatives towards securing your law firm’s network, here are the first three steps you can take to boost your cybersecurity strength and protect the confidentiality, integrity, and availability of your organization’s and clients’ information.
Step 1: Know Where Your Valuables Are And Where It Is Going
Consider why someone would want to gain access to your organization’s network. The biggest difference from a kiddie hacker and an organized, malicious actor is intent. In March of 2016, FBI’s cyber division announced it has come to their attention that hackers are specifically targeting international law firms as part of an insider trading scheme (Friedman, 2016). Knowing that the information you store is valuable to people other than your employees and your clients will help when identifying where information is, how it moves from one person to another and how it is accessed. Is it distributed via email? How is it stored and later accessed by a co-worker or client? Understanding what is valuable to others will help you identify what needs safe keeping and then the best strategy to guard that element. Along the same lines, know what cloud-computing software you are using and review the security protocols set in place by the vendor. Also, make sure you analyze any options or settings that involve ‘sharing’ documents. A breach to a cloud-based service where your documents are stored might be more common than you think (remember the Dropbox password reset from August 2016?), so consider encrypting all communication flow, hard drives, and documents stored in any cloud-based systems.
Step 2: Complete a Risk Assessment
After taking a comprehensive look at where the valuable data is located, how it is stored, how it is accessed as well as by who, and any endpoints, you can now work on gaining insight to areas you didn’t know were vulnerable. Start by contacting a cybersecurity organization that specializes in risk assessments as well as other security services to schedule an assessment of your organization’s cyber infrastructure. It is important to make sure the vendor you choose to utilize for an assessment will be using automated tools as well as manual techniques to provide more in-depth information about your network. The purpose of the assessment is to uncover weaknesses and identify critical flaws of the network that an attacker could exploit, so a thorough assessment of the network and systems security is paramount as it provides insight into areas you may not have thought of.
Upon completion of the assessment, the vendor should be able to provide you with a comprehensive list of vulnerabilities, in a manner that is easy to understand, easy to interpret, and easy to prioritize with financially feasible recommendations.
Now that you have a list of your cyber infrastructure’s vulnerabilities, you can begin planning so that you are reducing each risk.
Step 3: Make a Plan
Start by prioritizing each vulnerability and then develop the plan based on prioritization. What are the biggest concerns and areas of risk and what are the easy fixes, such as quick patches and installing updates that can quickly reduce the size of the list. Plan out how to tackle the list in a reasonable amount of time.
Getting down to the basics and tackling the items on the vulnerabilities report, one line item at a time, will help strengthen your security posture.
Moving forward, it’s best to think about cybersecurity as an ongoing and evolving element that strengthens the value of your organization and will help contribute to a positive organizational reputation. Increasing your awareness of assets that reside within the constraints of your infrastructure will help when recognizing potentially cost-effective, obtainable security solutions that can bolster your organization’s approach to cybersecurity.
1 Safeguarding your firm from cyber attacks Law Firm Services. PwC. 2012. https://www.pwc.com/us/en/law-firms/assets/pwc-safeguarding-your-firm-from-cyber-attacks.pdf
Friedman, G. (2016, March 11). FBI Alert Warns of Criminals Seeking Access to Law Firm Networks. Retrieved January 30, 2017, from https://bol.bna.com/fbi-alert-warns-of-criminals-seeking-access-to-law-firm-networks/