Protecting Your Law Firm in 2019: Part 1

From Equifax to The Panama Papers, recent history has seen its fair share of cybersecurity blunders. Breaches of well-known companies have proven that even largest and most secure corporations are susceptible to cyber attacks. And if you’re thinking that you may be too small to attack, think again — Ransomware is projected to attack a business every 14 seconds by the end of 2019, up from every 40 seconds this year.

It’s no surprise that law firms have a target on their back when it comes to hacking. Legal firms often deal with highly sensitive information and larger quantities of capital – any hackers dream. Lax security measures and the use of Internet of Things (IoT) devices, many of which lack proper protection, creates unknown vulnerabilities that could result in a digital disaster.

With legal client relationships based on confidentiality, even one publicised mishap can ruin a reputation. Today’s virtual workplace and the growing amount of digital tools servicing the legal industry make it more important than ever to have a contemporary and updated cybersecurity front. In this post, we’ll introduce you to the top three attacks you may face in 2019, then in part two, we’ll teach you exactly what you can do to avoid them.

 

1. Phishing

A Phishing scam is an act of using a fake notification, such as an email, to acquire important credentials from a victim. The notification is often disguised as a normal email, using brand logos and a URL that appears familiar. Leveraging the assumed trust, the scammer will ask for private information in order to fix an issue. With the unsavvy victim confused and vulnerable, they will usually forfeit their information, allowing the thief to easily access their accounts.  On average, 12-30% of people click on phishing messages and are the most common issues in cybersecurity.

 

2. Ransomware Infections:

Ransomware is exactly what it sounds like — a hacker will use a specific software to hold your information or accounts hostage until you can produce a required ransom. Unlike phishing, the information is seldom “taken” from the organization, rather it is obstructed from being accessed or used.

Ransomware can be especially dangerous depending on the infrastructure of an enterprise — while some can lock employees out of their email, others can shut down the entire website or operating system the company relies on.

According to Verizon’s 2018 Data Breach Investigations Report, organizations need to be on high alert for ransomware attacks. The most common causes of a ransomware breach are employee tricked into downloading a disguised file, visiting a compromised website that hides malicious code, a user opens a malicious email attachment, or a user clicks on a malicious link within an email message.

 

3. Distributed Denial-of-Service (DDoS) Attacks.

NETSCOUT Arbor revealed there were seven times more distributed denial (DDoS) attacks… observed during the first six months of 2018 compared to the first half of 2017. In this cyber attack, the perpetrator wants to make a computer or network unavailable. With the denial of service attacks (DoS), cybercriminals flood your site with an extortionate amount of traffic, either rendering it unusable or causing the system to crash.

By overloading a law firm’s internet server, criminals temporarily disrupt the firm’s ability to conduct business. The attack gives the perpetrator leverage for a number of malicious reasons, including holding the site at ransom. For firms relying on IoT services, DoS attacks are a very serious matter, as they can spread like a virus and cause invaluable lose of time and resources. They can also be the first sign of a larger, more complex attack. For this reason, monitoring your traffic to prevent a DoS attack should be at the top of your cybersecurity priorities.

Stay Tuned!

In our next blog, we’ll discuss various methods you can begin to implement for enhanced cyber safety and security.

From Equifax to The Panama Papers, recent history has seen its fair share of cybersecurity blunders. Breaches of well-known companies have proven that even largest and most secure corporations are susceptible to cyber attacks. And if you’re thinking that you may be too small to attack, think again — Ransomware is projected to attack a business every 14 seconds by the end of 2019, up from every 40 seconds this year.

It’s no surprise that law firms have a target on their back when it comes to hacking. Legal firms often deal with highly sensitive information and larger quantities of capital – any hackers dream. Lax security measures and the use of Internet of Things (IoT) devices, many of which lack proper protection, creates unknown vulnerabilities that could result in a digital disaster.

With legal client relationships based on confidentiality, even one publicised mishap can ruin a reputation. Today’s virtual workplace and the growing amount of digital tools servicing the legal industry make it more important than ever to have a contemporary and updated cybersecurity front. In this post, we’ll introduce you to the top three attacks you may face in 2019, then in part two, we’ll teach you exactly what you can do to avoid them.

 

1. Phishing

A Phishing scam is an act of using a fake notification, such as an email, to acquire important credentials from a victim. The notification is often disguised as a normal email, using brand logos and a URL that appears familiar. Leveraging the assumed trust, the scammer will ask for private information in order to fix an issue. With the unsavvy victim confused and vulnerable, they will usually forfeit their information, allowing the thief to easily access their accounts.  On average, 12-30% of people click on phishing messages and are the most common issues in cybersecurity.

 

2. Ransomware Infections:

Ransomware is exactly what it sounds like — a hacker will use a specific software to hold your information or accounts hostage until you can produce a required ransom. Unlike phishing, the information is seldom “taken” from the organization, rather it is obstructed from being accessed or used.

Ransomware can be especially dangerous depending on the infrastructure of an enterprise — while some can lock employees out of their email, others can shut down the entire website or operating system the company relies on.

According to Verizon’s 2018 Data Breach Investigations Report, organizations need to be on high alert for ransomware attacks. The most common causes of a ransomware breach are employee tricked into downloading a disguised file, visiting a compromised website that hides malicious code, a user opens a malicious email attachment, or a user clicks on a malicious link within an email message.

 

3. Distributed Denial-of-Service (DDoS) Attacks.

NETSCOUT Arbor revealed there were seven times more distributed denial (DDoS) attacks… observed during the first six months of 2018 compared to the first half of 2017. In this cyber attack, the perpetrator wants to make a computer or network unavailable. With the denial of service attacks (DoS), cybercriminals flood your site with an extortionate amount of traffic, either rendering it unusable or causing the system to crash.

By overloading a law firm’s internet server, criminals temporarily disrupt the firm’s ability to conduct business. The attack gives the perpetrator leverage for a number of malicious reasons, including holding the site at ransom. For firms relying on IoT services, DoS attacks are a very serious matter, as they can spread like a virus and cause invaluable lose of time and resources. They can also be the first sign of a larger, more complex attack. For this reason, monitoring your traffic to prevent a DoS attack should be at the top of your cybersecurity priorities.

Stay Tuned!

In our next blog, we’ll discuss various methods you can begin to implement for enhanced cyber safety and security.

How to Reduce Your Law Firm’s Cyber Risk

law firm cyber security

Experts agree that cybersecurity threats present significant risks to businesses, including law firms. Clients place a great deal of trust in law firms, which have a clear duty to protect their clients’ sensitive information. While bigger targets exist, hackers have begun targeting law firms because they found them to be the weakest link.

Law firms usually have relatively weak or non-existent cyber-defense systems or protocols in place. Fortunately, mitigating risks from data breaches or ransomware requires a small number of relatively simple measures. Here are some cybersecurity best practices any law firm can put in place.

1. Use Multi-Factor Authentication

Also known as two-factor authentication, this simple procedure makes use of a user password and something else the user has (e.g., token, app, device, etc.) to generate a second temporary password or code to login to an information system. It may seem cumbersome to require a password plus a second step, but it is the easiest procedure a law firm can implement to significantly improve security.

2. Never Share Logins or Passwords

Password sharing remains a common practice, even in businesses. Employees do this all the time, often just to give a coworker access to a program or to simplify login procedures from a remote location. In some cases, passwords can be found on notes sitting on employee desks or sticking to monitors.

Reusing accounts presents a similar risk. In this instance, employees continue to use the account of a departed employee to maintain access to a specific profile or to data that profile can access.

Law firms should eliminate password and login sharing, requiring their IT department to create new logins for incoming employees and delete old accounts.

3. Choose Better Passwords

law firm cyber security Passwords constitute the first, and sometimes only, line of defense against cyber-attacks. Hackers today use improved technology to crack passwords, ending the days when an employee could use the same simple password forever.

Law firms should require passwords that are longer, use more diverse characters, and are changed regularly. A good password consists of at least eight characters, a mix of letters, numbers, and special characters, a limitation on repeat characters (e.g., BB).

Each system should have a unique password, and law firm employees should be encouraged to vary passwords on different websites they access. Another good practice is to use an extremely complicated password for email accounts, which is needed to reset passwords. Password managers also exist to help manage many different accounts.

4. Update Systems

Installing updates, while often frustrating, protects an operating system from vulnerabilities. Upgrading the operating system to the current version (e.g., Windows 10 or Sierra) provides extra protection.

5. Encryption

This uses a formula to make data unreadable without a key. As long as the key is secure, the data remains safe. Several services exist that provide encryption, and the latest computers have encryption that simply needs to be enabled.

These steps are relatively easy to set up, but transform a firm’s cybersecurity. Law firms face risks like every other business. By enacting industry best practices, a law firm reduces the dangers of an attack and gives their clients the security they expect.

Contact Us

JDL Group can help your law firm adopt the right cyber security strategy. Contact us today.

Additional Resources:
http://www.onelegal.com/blog/5-steps-to-getting-serious-about-law-firm-cyber-security/
http://www.lawtechnologytoday.org/2017/02/tips-for-risk-mitigation/
http://www.lawtechnologytoday.org/2017/01/why-remote-security-is-a-must/
https://blog.lexicata.com/how-to-improve-data-security-at-your-law-firm/

ransomware attacks on law firms

law firm cyber security

Experts agree that cybersecurity threats present significant risks to businesses, including law firms. Clients place a great deal of trust in law firms, which have a clear duty to protect their clients’ sensitive information. While bigger targets exist, hackers have begun targeting law firms because they found them to be the weakest link.

Law firms usually have relatively weak or non-existent cyber-defense systems or protocols in place. Fortunately, mitigating risks from data breaches or ransomware requires a small number of relatively simple measures. Here are some cybersecurity best practices any law firm can put in place.

1. Use Multi-Factor Authentication

Also known as two-factor authentication, this simple procedure makes use of a user password and something else the user has (e.g., token, app, device, etc.) to generate a second temporary password or code to login to an information system. It may seem cumbersome to require a password plus a second step, but it is the easiest procedure a law firm can implement to significantly improve security.

2. Never Share Logins or Passwords

Password sharing remains a common practice, even in businesses. Employees do this all the time, often just to give a coworker access to a program or to simplify login procedures from a remote location. In some cases, passwords can be found on notes sitting on employee desks or sticking to monitors.

Reusing accounts presents a similar risk. In this instance, employees continue to use the account of a departed employee to maintain access to a specific profile or to data that profile can access.

Law firms should eliminate password and login sharing, requiring their IT department to create new logins for incoming employees and delete old accounts.

3. Choose Better Passwords

law firm cyber security Passwords constitute the first, and sometimes only, line of defense against cyber-attacks. Hackers today use improved technology to crack passwords, ending the days when an employee could use the same simple password forever.

Law firms should require passwords that are longer, use more diverse characters, and are changed regularly. A good password consists of at least eight characters, a mix of letters, numbers, and special characters, a limitation on repeat characters (e.g., BB).

Each system should have a unique password, and law firm employees should be encouraged to vary passwords on different websites they access. Another good practice is to use an extremely complicated password for email accounts, which is needed to reset passwords. Password managers also exist to help manage many different accounts.

4. Update Systems

Installing updates, while often frustrating, protects an operating system from vulnerabilities. Upgrading the operating system to the current version (e.g., Windows 10 or Sierra) provides extra protection.

5. Encryption

This uses a formula to make data unreadable without a key. As long as the key is secure, the data remains safe. Several services exist that provide encryption, and the latest computers have encryption that simply needs to be enabled.

These steps are relatively easy to set up, but transform a firm’s cybersecurity. Law firms face risks like every other business. By enacting industry best practices, a law firm reduces the dangers of an attack and gives their clients the security they expect.

Contact Us

JDL Group can help your law firm adopt the right cyber security strategy. Contact us today.

Additional Resources:
http://www.onelegal.com/blog/5-steps-to-getting-serious-about-law-firm-cyber-security/
http://www.lawtechnologytoday.org/2017/02/tips-for-risk-mitigation/
http://www.lawtechnologytoday.org/2017/01/why-remote-security-is-a-must/
https://blog.lexicata.com/how-to-improve-data-security-at-your-law-firm/

ransomware attacks on law firms