As breaches become more commonplace in our society, organizations regardless of size and sector, are being targeted and exploited by a diverse set of cyber threat actors. Unsurprisingly, law firms are finding themselves in the crosshairs of these actors looking to find sensitive data or compromise potential accesses these firms have to other, perhaps more lucrative, organizations. There is a perception that law firms have not maintained a robust cyber security posture and as a result, likely have not reported incidents of breaches in order to avoid scrutiny and public exposure. Given the fact that law firms store confidential and proprietary information, it is easy to see why firms are prime targets for enterprising cyber criminals.
Like any enterprise facing daily attacks in the digital domain, law firms must develop cyber security strategies that best protect valuable information from these hostile actors. Such strategies take into account informational and technical security solutions to harden their cyber security postures while making them resilient to natural and digital disasters they may encounter. While there is a myriad of threats that all organizations need to be cognizant of, it is inconceivable that they will be able to address all security concerns with the same amount of dedicated financial, material, and personnel resources.
Adopting a risk-management approach can help any sized law firm develop and implement a strategy that best economically supports their needs. The better these firms can identify key information and accesses that enable their business models, the better positioned they will be to select the right technological and informational solutions according to budgetary and network architecture constraints.
One of the first steps is to identify key data that is critical to the business such as client information or employee personally identifiable information. Once this has been determined, consideration can be given to how such information should be protected, such as limiting access to whoever is able to access the information, implementing two-factor authentication, encrypting the data, or moving this information to a third-party cloud service for protection.
Another factor law firms need to consider is developing and implementing cyber security policies to dictate how information and information systems are to be used and handled. Coupled with this is the need to train all staff on not only how to use these properly and effectively, but to provide frequent user awareness training against new and emerging threats. Since the first cyber line of defense for any organization are the individuals that use computers, ensuring that their knowledge is up-to-date and having a means to report questionable issues such as e-mail spam, will greatly reduce the chance of phishing e-mails, or worse, the malware flavor of the month – ransomware.
No matter how robust an organization’s cyber security posture is, the reality is that a breach is an inevitability. Knowing this, law firms should develop contingency plans for various cyber-related events. Incident response and continuity of operations are essential plans that need to be developed and exercised to ensure their viability. The implementation of these will greatly help law firms be able to operate while simultaneously detecting, mitigating, and remediating the threat. The key objective here is to remain resilient, and the faster a firm can get back on its feet after an incident, the better it will be able to communicate to the public and its clients that the confidentiality, integrity, and availability of their resources is secured.
Some firms may allow or possess third-party accesses. This means that either a trusted partner has access to the firm’s networks or the firm may have access to a client’s network. Managing third party risk is essential for law firms via established compliance measures, regular testing, frequent auditing, and limiting network access to narrow the threat aperture.
Finally, being prepared with a communications strategy to provide transparency to both customers and the public at large is essential to maintaining trust and customer confidence. Such communication will greatly reduce uncertainty and help law firms preserve the integrity of their brand.
Law firms that are able to demonstrate that they have cyber security strategies in place to include incident and contingency planning, position themselves to meet the challenges of today’s cyber threat landscape.
