How to Reduce Your Law Firm’s Cyber Risk

law firm cyber security

Experts agree that cybersecurity threats present significant risks to businesses, including law firms. Clients place a great deal of trust in law firms, which have a clear duty to protect their clients’ sensitive information. While bigger targets exist, hackers have begun targeting law firms because they found them to be the weakest link.

Law firms usually have relatively weak or non-existent cyber-defense systems or protocols in place. Fortunately, mitigating risks from data breaches or ransomware requires a small number of relatively simple measures. Here are some cybersecurity best practices any law firm can put in place.

1. Use Multi-Factor Authentication

Also known as two-factor authentication, this simple procedure makes use of a user password and something else the user has (e.g., token, app, device, etc.) to generate a second temporary password or code to login to an information system. It may seem cumbersome to require a password plus a second step, but it is the easiest procedure a law firm can implement to significantly improve security.

2. Never Share Logins or Passwords

Password sharing remains a common practice, even in businesses. Employees do this all the time, often just to give a coworker access to a program or to simplify login procedures from a remote location. In some cases, passwords can be found on notes sitting on employee desks or sticking to monitors.

Reusing accounts presents a similar risk. In this instance, employees continue to use the account of a departed employee to maintain access to a specific profile or to data that profile can access.

Law firms should eliminate password and login sharing, requiring their IT department to create new logins for incoming employees and delete old accounts.

3. Choose Better Passwords

law firm cyber security Passwords constitute the first, and sometimes only, line of defense against cyber-attacks. Hackers today use improved technology to crack passwords, ending the days when an employee could use the same simple password forever.

Law firms should require passwords that are longer, use more diverse characters, and are changed regularly. A good password consists of at least eight characters, a mix of letters, numbers, and special characters, a limitation on repeat characters (e.g., BB).

Each system should have a unique password, and law firm employees should be encouraged to vary passwords on different websites they access. Another good practice is to use an extremely complicated password for email accounts, which is needed to reset passwords. Password managers also exist to help manage many different accounts.

4. Update Systems

Installing updates, while often frustrating, protects an operating system from vulnerabilities. Upgrading the operating system to the current version (e.g., Windows 10 or Sierra) provides extra protection.

5. Encryption

This uses a formula to make data unreadable without a key. As long as the key is secure, the data remains safe. Several services exist that provide encryption, and the latest computers have encryption that simply needs to be enabled.

These steps are relatively easy to set up, but transform a firm’s cybersecurity. Law firms face risks like every other business. By enacting industry best practices, a law firm reduces the dangers of an attack and gives their clients the security they expect.

Contact Us

JDL Group can help your law firm adopt the right cyber security strategy. Contact us today.

Additional Resources:
http://www.onelegal.com/blog/5-steps-to-getting-serious-about-law-firm-cyber-security/
http://www.lawtechnologytoday.org/2017/02/tips-for-risk-mitigation/
http://www.lawtechnologytoday.org/2017/01/why-remote-security-is-a-must/
https://blog.lexicata.com/how-to-improve-data-security-at-your-law-firm/

ransomware attacks on law firms

law firm cyber security

Experts agree that cybersecurity threats present significant risks to businesses, including law firms. Clients place a great deal of trust in law firms, which have a clear duty to protect their clients’ sensitive information. While bigger targets exist, hackers have begun targeting law firms because they found them to be the weakest link.

Law firms usually have relatively weak or non-existent cyber-defense systems or protocols in place. Fortunately, mitigating risks from data breaches or ransomware requires a small number of relatively simple measures. Here are some cybersecurity best practices any law firm can put in place.

1. Use Multi-Factor Authentication

Also known as two-factor authentication, this simple procedure makes use of a user password and something else the user has (e.g., token, app, device, etc.) to generate a second temporary password or code to login to an information system. It may seem cumbersome to require a password plus a second step, but it is the easiest procedure a law firm can implement to significantly improve security.

2. Never Share Logins or Passwords

Password sharing remains a common practice, even in businesses. Employees do this all the time, often just to give a coworker access to a program or to simplify login procedures from a remote location. In some cases, passwords can be found on notes sitting on employee desks or sticking to monitors.

Reusing accounts presents a similar risk. In this instance, employees continue to use the account of a departed employee to maintain access to a specific profile or to data that profile can access.

Law firms should eliminate password and login sharing, requiring their IT department to create new logins for incoming employees and delete old accounts.

3. Choose Better Passwords

law firm cyber security Passwords constitute the first, and sometimes only, line of defense against cyber-attacks. Hackers today use improved technology to crack passwords, ending the days when an employee could use the same simple password forever.

Law firms should require passwords that are longer, use more diverse characters, and are changed regularly. A good password consists of at least eight characters, a mix of letters, numbers, and special characters, a limitation on repeat characters (e.g., BB).

Each system should have a unique password, and law firm employees should be encouraged to vary passwords on different websites they access. Another good practice is to use an extremely complicated password for email accounts, which is needed to reset passwords. Password managers also exist to help manage many different accounts.

4. Update Systems

Installing updates, while often frustrating, protects an operating system from vulnerabilities. Upgrading the operating system to the current version (e.g., Windows 10 or Sierra) provides extra protection.

5. Encryption

This uses a formula to make data unreadable without a key. As long as the key is secure, the data remains safe. Several services exist that provide encryption, and the latest computers have encryption that simply needs to be enabled.

These steps are relatively easy to set up, but transform a firm’s cybersecurity. Law firms face risks like every other business. By enacting industry best practices, a law firm reduces the dangers of an attack and gives their clients the security they expect.

Contact Us

JDL Group can help your law firm adopt the right cyber security strategy. Contact us today.

Additional Resources:
http://www.onelegal.com/blog/5-steps-to-getting-serious-about-law-firm-cyber-security/
http://www.lawtechnologytoday.org/2017/02/tips-for-risk-mitigation/
http://www.lawtechnologytoday.org/2017/01/why-remote-security-is-a-must/
https://blog.lexicata.com/how-to-improve-data-security-at-your-law-firm/

ransomware attacks on law firms

 

data protection NJ NYC

While many cyber-risks exist, it’s the users of the protected system who constitute the greatest danger to effective cybersecurity procedures. An overwhelming majority of cyber attacks begin when a user clicks a link they shouldn’t. How are users tricked into clicking these links?

This is accomplished through what is known as a phishing email. This describes an email designed to look like a communication from a well-known, trusted entity, (e.g., Facebook, Bank of America, etc.) which tricks the recipient into clicking the link, and exposing the system to the cyber-attack. The best defense against this attack is an informed workforce, trained to remain vigilant, and to recognize a scam. Here are some best practices your law firm can put in place to protect your employees and clients from these attacks.

Password Managers

Phishing sites pretend to be real entities to fool a user with near identical-looking sites or URLs. To avoid being tricked, train your lawyers and employees to not rely on their own judgment, but to use a password manager to check the authenticity of the site. These programs auto-fill usernames and passwords on the correct domains, but refuse to do so on an incorrect website.

Two-Factor Authentication

This form of security, also known as multi-factor authentication, requires a username and password be used in conjunction with another factor only the user possesses, like information, a token, or a device. Many law firms already require this for physical and information system access. Adding this layer to an email system further protects sensitive data, blocking unauthorized users from viewing protected data.

Employee Metadata and PII

data protection NJ NYCDocuments carry certain data unique to the user who created it, also known as metadata. To prevent client or employee Personally Identifiable Information (PII) from accidentally being exposed, users should be required to convert email attachments into PDFs or inspect documents in Office to remove hidden metadata.

Emails present the same threat, data that is targeted with spymail containing code that steals embedded recipient metadata. This data can include physical location, email statistics, and sending history, which aids a phisher in creating more deceptive emails. Law firms should employ a centralized anti-spymail tool, but users can also reduce risks by stopping external content from automatically loading (e.g., preventing pictures from being displayed when the email is opened).

Increase Awareness with Cybersecurity Training

Users form the first line of defense against phishing scams, so law firms should require training programs teaching steps their lawyers and  employees can use to protect themselves and the firm. Train all users to be discerning regarding who the sender is, refusing to open emails or attachments from unknown senders. Users can compare the actual company URL the phishing email is imitating to the link provided in the email. If an email arrives with embedded or attached forms, never insert sensitive data into the form.

Users should question any email asking for financial information, especially account update notifications, wire transfer requests, or failed transaction alerts. Threats to disable an account or reduce service support are a clear sign of a scam. In all cases contact the merchant directly, rather than responding to the email. The best defense against phishing scams is an educated workforce. Investing in cybersecurity training will reduce the risks to sensitive data and prevent costly responses to a cyber-attack.

Contact Us

Looking for more help with phishing protection? Contact us today.

Additional Resources:
https://www.darkreading.com/endpoint/91–of-cyberattacks-start-with-a-phishing-email/d/d-id/1327704
http://www.law.com/sites/almstaff/2017/06/29/dla-piper-isnt-alone-40-percent-of-law-firms-unaware-of-breaches/?slreturn=20170827131100
http://www.abajournal.com/news/article/dont_click_lawyers_get_fake_emails_about_a_complaint_hyperlink_installs_mal
http://abovethelaw.com/2016/12/dont-fall-for-scams-in-smalllaw/?rf=1
https://www.law360.com/articles/957163/law-firm-duped-by-email-scammers-in-wage-and-hour-case
https://www.consumerreports.org/money/how-to-protect-yourself-from-phishing/ 

 

ransomware attacks on law firms