Cybersecurity risks are spread-out across industries, some more than others. Law firms are a conducive target for cyber-attackers due to the sensitive nature of information they hold. Despite of a spike in reported incidents (while many go unreported), law firms continue to be vulnerable from a cybersecurity stand-point. To counter the rising cybersecurity threat, the American Bar Association issued the Formal Opinion 483 (The Opinion). The Opinion lays-out cybersecurity best practices for Law Firms along with responsibilities to prevent, report, and communicate security incidents. Here is a list of top threats and vulnerabilities law firms must look-out for:
Email Security
Email is a primary mode of communication for many law-firms. They exchange documents and share information over emails. Though with increase in cybersecurity awareness, law firms are taking precautionary measures to limit the details shared via email. Still there are regular reports of data-breach caused by lapse in email security. Phishing emails are primary perpetrator behind these attacks. Criminals share links to malicious sites through phishing emails and once users click and goes to those sites, they get exposed to potential data-breach. Criminals use phishing emails to bypass security firewalls and get access to client network.
Ransomware
In the recent past, Ransomware has wrecked havoc at many businesses by getting access to their critical data. Criminals encrypt data and demand ransom to decrypt it. Failing to pay ransom on-time could lead to permanent deletion of data. Paying-up is not a formidable solution as (a) there is no guarantee of recovery, and (b) criminals may come-back knowing vulnerabilities in system. Taking measures proactively to strengthen cybersecurity is the ideal tactic to fight ransomware.
Network Security
Cyber criminals persistently make attempt to break into networks and gain access to sensitive data. Criminals gain encouragement from the fact that most Small and Medium Enterprises (SMEs) do not do enough to protect their network. This results in vulnerabilities that criminals take advantage of. The myth needs to be busted that only big enterprises are at risk. Law firms of all sizes must protect their network by getting security experts look at their network and adopt necessary measures.
Cybersecurity Program
What to do when client data gets compromised? Are we following security protocols to protect client data? How do we report a breach incident? These are some common questions every law firms must ask themselves and answer. Many law firms are ill prepared to handle cybersecurity breach related incidents and as a result jeopardize not just their chances of fast recovery but also their reputation. Cybersecurity incidents are detrimental to law firms’ credibility to secure client data. As a result, they get exposed to potential law-suits and loss of brand reputation. Having a cybersecurity program should be considered as part of any law firm’s operations to ensure proper cybersecurity measures are followed to protect data.
The Opinion addresses some of these cybersecurity concerns heads-on by outlining best practices for law firms. There is a need for standardization of basic cybersecurity measures across the legal services industry irrespective of size. CompCiti is hosting a webinar on Opinion 483: A Cybersecurity Obligation for Law Firms to share more information on the Opinion and how law firms can better protect their client data. Click here to Register for the webinar on June 19, 2019.
