Law firms are a one-stop-shop for cyber criminals – not only can they get their hands on large financial transactions, but there’s plenty of sensitive, highly valuable client information to be had too. Protecting this confidential information is paramount to law firms keeping their reputation – and the reputations of their clients – intact.
Confidentiality is at the heart of the legal sector, with individuals and businesses alike placing their trust in law firms to transact securely and discreetly on their behalf. A breach of this trust can mean the end of the road for a law firm – just look at Mossack Fonseca, the firm that lost 11.5 million documents (2.6TB of data) in a 2016 breach dubbed the ‘Panama Papers’, due to weaknesses in their client portal which hadn’t been updated1. The sensitive information in those documents about wealthy, famous, and public office clients was exposed to the press. Mossack Fonseca never recovered from the massive reputational damage caused by the breach, and was forced to close.
Law firms’ reliance on digitised information makes them particularly vulnerable to data breaches. They are accustomed to taking instruction and conducting transactions almost exclusively via email, including the transfer of extensive amounts of confidential, personal, and financial information. The constant movement of this information increases the risk of exposure.
The press loves a scandal
The affairs of high net worth individuals are temptingly lucrative targets for cyber criminals. Secrets and scandals sell newspapers. The 2017 ‘Paradise Papers’ scandal saw 13.4 million files leaked to the International Consortium of Investigative Journalists. The documents were stolen from Appleby, a major offshore law firm based in Bermuda that “specialises in advising some of the world’s wealthiest individuals”2. The files showed the multitude of ways companies and affluent individuals avoid tax, and included names and financial information3. Needless to say, the press had a field day.
Getting personal
It’s not just the rich and famous who are at risk of having their confidential information stolen. Enlisting the services of a law firm normally involves sharing a small library of personal information which, in the wrong hands, could easily lead to identify theft and fraud. Clients’ names, addresses, dates of birth, financial records, and sometimes medical information are all held by law firms, and usually transferred by email.
Law firms need to be particularly careful with this level of sensitive personal information, not least because of the further crimes it could be used for if stolen. The introduction of the GDPR in 2018 has already seen eye-watering fines making the headlines for Marriott and BA. Any breach of personal information must be reported, and fines are levied against the company that held the data for not adequately protecting it.
“The loss of client information can have a devastating impact on a sector that has confidentiality at the heart of its business" 4
Are you the weakest link?
Law firms are privy to some of the world’s most sought-after business secrets, through their contracts and transactions with multinational businesses. State-sponsored attacks are a daily occurrence against these businesses, targeting their top secret IP to gain a commercial advantage. Can you guarantee to protect your clients’ confidential business information from some of the most powerful people in the world?
Cyber criminals are sometimes much more subtle in their approach than targeting the big fish straightaway. Smaller law firms are more likely to outsource certain services to external suppliers, especially for large contracts – these third party systems can provide an easy route in for cyber criminals if they’re not sufficiently secure. All it takes is a poorly protected link in the supply chain to lead to infringement of sensitive data and privileged information. You need to be able to demonstrate that your law firm can protect all client information you deal with, both up and down the supply chain.
What can be done?
Law firms are required to go through rigorous checks and certifications to transact as a law firm, which engenders implicit trust that the firm clients are dealing with is legitimate and secure. Clients don’t expect that such a pillar of security can be spoofed and compromised by cyber criminals. Make sure you can keep hold of the secrets your clients entrust you with.
The potential cost of a data breach – including malpractice suits, significant loss of business, and hefty GDPR fines – is substantially more than the cost of implementing preventative measures. Ensure your law firm’s cyber security strategy includes proactive detection methods that flag non-compliance and potential data breaches before they can occur. PERNIX’s CC checker, for example, scans all outbound emails to identify if multiple email addresses have been entered into the CC field, which could constitute a GDPR breach. If such an event is detected, the email is quarantined to prevent the breach, and the IT admin notified.
CORVID Managed Detection and Response proactively hunts for tell-tale signs of malicious activity within your IT estate, so cyber criminals attempting to harvest and exfiltrate data are stopped and removed before they can cause a breach.
If a data breach does occur, your firm needs to be able to prove compliance with strict data protection regulations, by confidently and accurately reporting exactly what information was accessed, who accessed it, and whether the data was exfiltrated from your systems. Our Managed Detection and Response solution articulates clear and detailed answers to the four key questions:
- How and where did the security breach take place?
- What information was accessed?
- How can you recover your systems quickly?
- How do you prevent it from happening again?
This comprehensive response enables you to complete your report to the ICO in full. We are also able to positively confirm no reportable incident on your behalf, giving reassurance to your clients and stakeholders that your systems are secure.
Protect your law firm against email-based attacks
Email is the single biggest attack vector, yet Legal Security Forum reported that “only 16% of the top 95 law firms in the UK have sufficient measures in place to fully protect against email fraud”5.
The information on your law firm’s website is making it easy for cyber criminals to impersonate you via email, which makes requests for sensitive data and privileged information more credible and therefore more likely to succeed. Download our free PDF guide on the three ways the information on your website is making it easy for attackers, to understand how to better protect your firm from these reputation-ruining attacks.
Find out more about how CORVID can benefit the legal sector.
Footnotes
- 'The cyber threat to UK legal sector' 2018 report
- Law Firm Data Breach Could Be Panama Papers 2.0
- Paradise Papers Tax havens What are the Paradise Papers and what do they tell us?
- 'The cyber threat to UK legal sector' 2018 report
- 'New research shows 84% of UK law firms still vulnerable to email fraud – cyber attacks remain the biggest threat to a £26 billion industry'
More CORVID blog posts
An introduction to cybersecurity for decision-makers
Cybersecurity is an industry, a field of academia, a buzz-word, a science, an art and a bogeyman. And whilst cybersecurity cannot be avoided within any organisation that relies upon computers and data: there needs to be a way by which senior decision-makers can be involved in, and make decisions on, cybersecurity matters.
Cybersecurity is a highly specialised subject. It is complex and requires significant of knowledge and experience that is different from normal IT-knowledge. Knowing jargon and buzzwords does not mean that someone is an expert so always check the credentials of your “trusted advisors”.
Despite its overuse as a term, cybersecurity is fundamentally about protecting computer systems and data.
There are rules
Most territories now have laws around Data Privacy and many industries have regulations around information security. These must always be complied with and, irrespective of whether they are useful, they are necessary to operate in specific sectors.
Whilst the regulatory requirements may originate from the best of intentions: it is likely that organisations will need to do additional things to have the right type of cybersecurity for their specific profile and operations.
Why does anyone need cybersecurity?
Questioning why cybersecurity is needed is a good starting-point as it helps anchor solutions and initiatives to the fundamental driver behind activity in this space.
- The more you rely on (take advantage of) IT, therefore
- The bigger an impact to the organisation if something goes wrong, therefore
- The more you need cybersecurity
Cybersecurity needs to be seen as an enabler to using IT. Without cybersecurity, reliance upon IT is an incredibly risky thing to do. In-fact, one of the oldest risk equations in InfoSec (Information Security) works as follows:
Threat[1] x Impact[2] x Opportunity (Vulnerability)[3] = RISK
In mathematics if anything is multiplied by zero then the answer is zero. If there were no Threats there would be no Risk. If there was no Impact there would be no Risk and if there was no Opportunity to compromise a system there would be no Risk.
There are formal methodologies to measure the level of risk to an organisation as a result of a computer security breach. Sometimes formal assessments are useful to help shine a light on the scale of the issue. But if you are not required to undertake them then, in most cases, there is little benefit in going down this route.
Cybersecurity is a cost and, like other costs, it should be managed. For many organisations this means that the goal is to spend as little as possible on cybersecurity whilst having a proportionate level of protection considering the risk. Getting that proportionality right can be a challenge. Cybersecurity is routinely both a victim to underspending, where there is a lack of appreciation of the subject, and a cause of overspending, where the expenditure has not been objective focussed and consequently failed to achieve a useful outcome.
There are three fundamentals that an organisation needs to do regarding cybersecurity:
- Prevent an incident from occurring[4] – not all incidents can be prevented
- Detect an incident that has occurred – anti-virus cannot detect all incidents
- Respond well to an incident that has occurred – a good response can negate the impact of an incident
There may be exceptions to the above; but in-general all cybersecurity expenditure should be aligned to at least one of those three. Therefore, mapping initiatives against them can be a useful activity. Combining this with an articulation of effectiveness (a metric is best) is useful as it helps focus the initiative on the right outcomes for the organisation. At the risk of repetition: remember that cybersecurity is highly specialised. It requires specialist tools in the hands of specialist practitioners. Whilst an organisation could build their own Security Operations Centre (SOC), the question of “why?” should be raised. A company could generate its own electricity: but why would it do so?
Cyber expenditure almost always consists of both:
- Anticipated expenditure – the cost of the tool, service or technology
- Additional impact – specialist and (or) additional people, extra-training, recruitment, facilities and a distraction from core business
The following matrix (with a made-up example) is provided to help characterise cybersecurity initiatives. It is intended to be completed quickly, on the back of a post-it note, to help rapidly focus attention on the nature of the investment and whether the benefit, costs and approach have been considered. It is not intended to replace a full-investment case.
Final notes
No matter how much is spent on cybersecurity, and no matter what you are told, no company or product can guarantee safety. All anyone can do is make it less likely that an organisation will be compromised or reduce the impact of compromise. The inverse, i.e. not spending any money on cybersecurity, does not guarantee that an organisation will suffer a security breach. Not every organisation gets hit and some organisations are lucky. However, a strategy requiring luck is not recommended.
Whilst cybersecurity should be on the agenda: it should not monopolise it. Cybersecurity should be frictionless and, ideally, left to the professionals who should take the pain of it away. If cybersecurity is routinely causing you pain it is worth asking whether it is being managed as well as it could be.
Footnotes
[1] “Threat” refers to the groups or persons who do the attacking: Hackers, Nation States, Hacktivists. The entities that undertake the attack.
[2] Impact is not just the confidentiality breach of information. Depending on the circumstances, availability or integrity compromises can be highly impactful.
“Impact” is the impact to your organisation if they succeed in stealing, destroying, changing or making your systems and data unavailable.
[3] “Opportunity (Vulnerability)” is a measure of how accessible the systems and data are to attackers. Very secure government systems are not directly connected to the Internet and this reduces the Opportunity of attack considerably.
[4] Attackers have access to all the same technology that the defenders have and despite the prevalence of firewalls and anti-virus (both of which are much needed by the way), they are still able to breach organisations security and gain access to systems and data. Prevention is better than cure, but it’s just not practical to rely solely on this element.
Patching up life support: why critical care is at critical risk
Keeping people alive is unquestionably more important than patching software, but unpatched software is vulnerable to exploitation, and won’t keep anyone alive if it leads to a breach of your IT systems, rendering them unavailable.
After WannaCry exploited unpatched Windows XP vulnerabilities and cost the NHS £92m, healthcare providers across the country carried out a mass upgrade to Windows 10. Making the move to the newer OS is synonymous with increased security (you’d be worried if it wasn’t…), but there is growing concern that it was seen as a tick box, one-off exercise. Now the OS that was exploited is no longer in use, healthcare providers feel safer. This is a dangerously complacent assumption – new vulnerabilities are identified almost daily, creating an ‘arms race’ between attackers and vendors; one looking to exploit the other looking to get patches out.
The issue is further compounded as not all systems made it to Windows 10 – legacy IT systems remain where the service they provide can only run on the legacy OS. This particular stumbling block can make the health sector an easier target. Cyber attackers aren’t renowned for being a particularly moral bunch, so if they can shut down a hospital’s life support system and demand a hefty a ransom to get it back up and running again, they’ll take that payday without a second thought as to the consequences.
Let’s not forget that despite its wealth of valuable confidential data, the healthcare sector isn’t always necessarily the prime target for cyber criminals.
In the midst of the novel coronavirus pandemic, certain threat actor groups have claimed they won’t be targeting healthcare providers, but can’t rule out accidentally compromising systems if they’re not patched properly. Without a robust patch management programme in place, the sector can easily become an unintentional casualty of cyber attackers looking to exploit any vulnerabilities in any business. Just look at WannaCry.
The NHS is the nation’s beating heart, and healthcare providers know better than anyone that a beating heart stopping is a very bad thing. You can’t fix vulnerabilities you don’t know about, but you can guarantee threat actors will find them. You need full visibility of where your IT estate’s weaknesses are, and clear guidance on how to fix them. Even if you’re not a target, an unpatched infrastructure leaves you open to exploitation by opportunistic cyber attackers and widespread malware campaigns.
We’d like to offer all healthcare providers a free introductory scoping call to discuss how CORVID can help you identify and patch vulnerabilities and strengthen your cyber defences. Simply let us know what time is best for you, and we’ll do the rest.
