data protection NJ NYC

While many cyber-risks exist, it’s the users of the protected system who constitute the greatest danger to effective cybersecurity procedures. An overwhelming majority of cyber attacks begin when a user clicks a link they shouldn’t. How are users tricked into clicking these links?

This is accomplished through what is known as a phishing email. This describes an email designed to look like a communication from a well-known, trusted entity, (e.g., Facebook, Bank of America, etc.) which tricks the recipient into clicking the link, and exposing the system to the cyber-attack. The best defense against this attack is an informed workforce, trained to remain vigilant, and to recognize a scam. Here are some best practices your law firm can put in place to protect your employees and clients from these attacks.

Password Managers

Phishing sites pretend to be real entities to fool a user with near identical-looking sites or URLs. To avoid being tricked, train your lawyers and employees to not rely on their own judgment, but to use a password manager to check the authenticity of the site. These programs auto-fill usernames and passwords on the correct domains, but refuse to do so on an incorrect website.

Two-Factor Authentication

This form of security, also known as multi-factor authentication, requires a username and password be used in conjunction with another factor only the user possesses, like information, a token, or a device. Many law firms already require this for physical and information system access. Adding this layer to an email system further protects sensitive data, blocking unauthorized users from viewing protected data.

Employee Metadata and PII

data protection NJ NYCDocuments carry certain data unique to the user who created it, also known as metadata. To prevent client or employee Personally Identifiable Information (PII) from accidentally being exposed, users should be required to convert email attachments into PDFs or inspect documents in Office to remove hidden metadata.

Emails present the same threat, data that is targeted with spymail containing code that steals embedded recipient metadata. This data can include physical location, email statistics, and sending history, which aids a phisher in creating more deceptive emails. Law firms should employ a centralized anti-spymail tool, but users can also reduce risks by stopping external content from automatically loading (e.g., preventing pictures from being displayed when the email is opened).

Increase Awareness with Cybersecurity Training

Users form the first line of defense against phishing scams, so law firms should require training programs teaching steps their lawyers and  employees can use to protect themselves and the firm. Train all users to be discerning regarding who the sender is, refusing to open emails or attachments from unknown senders. Users can compare the actual company URL the phishing email is imitating to the link provided in the email. If an email arrives with embedded or attached forms, never insert sensitive data into the form.

Users should question any email asking for financial information, especially account update notifications, wire transfer requests, or failed transaction alerts. Threats to disable an account or reduce service support are a clear sign of a scam. In all cases contact the merchant directly, rather than responding to the email. The best defense against phishing scams is an educated workforce. Investing in cybersecurity training will reduce the risks to sensitive data and prevent costly responses to a cyber-attack.

Contact Us

Looking for more help with phishing protection? Contact us today.

Additional Resources:
https://www.darkreading.com/endpoint/91–of-cyberattacks-start-with-a-phishing-email/d/d-id/1327704
http://www.law.com/sites/almstaff/2017/06/29/dla-piper-isnt-alone-40-percent-of-law-firms-unaware-of-breaches/?slreturn=20170827131100
http://www.abajournal.com/news/article/dont_click_lawyers_get_fake_emails_about_a_complaint_hyperlink_installs_mal
http://abovethelaw.com/2016/12/dont-fall-for-scams-in-smalllaw/?rf=1
https://www.law360.com/articles/957163/law-firm-duped-by-email-scammers-in-wage-and-hour-case
https://www.consumerreports.org/money/how-to-protect-yourself-from-phishing/ 

 

ransomware attacks on law firms

Responding to a Data Breach Best Practices

 

All organizations, private or public, depend on stored data. Companies and governments implement procedures to protect their data, especially Personally Identifiable Information (PII). Despite this, breaches continue to happen and every organization needs to prepare for this eventuality, rather than doing damage control and dealing with the fallout after a breach.

To be prepared, a breach response plan should be established, detailing which teams will take action in the event of a breach to inform affected clients, respond to the media, and block the intruder and eliminate the weakness that led to the breach. What are some of the basic elements of an incident response plan? Here are a few critical components every plan should include.

Information Inventory

Keep detailed information on what data the company collected, processed, and stored, where that information is stored, and access privileges. Prioritize the data according to sensitivity, compliance requirements, and total damage that could be done if lost. If your storage plan includes the cloud, specify where those servers are located, what protections are in place, and who has access to the data stored there.

Monitor Access/Audit

data breaches NJIT departments usually carry out monitoring processes, but the breach response plan should include procedures on monitoring access and completing audits. Many organizations fail to completely remove old accounts or compartmentalize data access.

Be Aware of Compliance Requirements

Healthcare and financial services information assurance are heavily monitored. Stay informed on what regulations exist that affect company data and audit the procedures regularly to ensure continued compliance with changing laws. Make sure all requirements and recommended steps are covered in a response plan.

Assess Your Legal Risks

Data breaches can lead to long, expensive class-action lawsuits. Include in a response plan a list of contracted legal agencies that specialize in breach response so a company can activate their teams immediately.

Establish a Crisis Communication Plan

By far the most important element of a response plan. Clear chains of communication will eliminate confusion and ensure each party knows exactly what they need to know. Any teams and assigned leaders from various departments that play a role in the internal and external communication processes should be included. If a company employs an outside agency to handle external communications (e.g., drafting/sending letters, press conferences, informing law enforcement agencies, etc.) following a breach, list these on the plan and clearly identify how that agency will be contacted.

Practice Incident Response Plans

A successful response plan relies on team members and any third-party agencies knowing their roles and being able to execute them correctly. For this to happen, incident response plans should be practiced regularly, especially communication procedures. This is especially important after an update to the response plan. Repetition helps team members internalize their roles, turning responses into automatic actions.

A successful response requires planning, attention to detail, informed team members, clear lines of communication, and constant vigilance. A response team that knows their roles, and practices the procedures, is a team that will succeed. While data breaches will remain a risk, being prepared remains the best defense, and that depends on having the right response plan in place.

Contact Us

Don’t let your data fall into the wrong hands, contact us today.

Additional Resources:
https://www.ftc.gov/news-events/blogs/business-blog/2016/10/responding-data-breach
https://www.ftc.gov/system/files/documents/plain-language/pdf-0154_data-breach-response-guide-for-business.pdf
https://usa.visa.com/dam/VCOM/global/support-legal/documents/responding-to-a-data-breach.pdf
http://ptac.ed.gov/sites/default/files/checklist_data_breach_response_092012.pdf
http://www.prim.osd.mil/cap/cio-ia.html
https://www.forbes.com/sites/allclearid/2015/08/27/the-first-three-things-to-do-in-a-data-breach-response/#1964e735b53e
https://www.tripwire.com/state-of-security/security-data-protection/cyber-security/the-right-way-to-respond-to-a-data-breach/
https://www.dlapiper.com/~/media/Files/Insights/Publications/2015/04/Cyberdata_breach_response_checklist_V7.pdf
http://www.lindquist.com/portalresource/LindquistDataBreachGuide.pdf
https://www.stoutadvisory.com/insights/article/practical-steps-responding-data-breach  

 

ransomware attacks on law firms

 

All organizations, private or public, depend on stored data. Companies and governments implement procedures to protect their data, especially Personally Identifiable Information (PII). Despite this, breaches continue to happen and every organization needs to prepare for this eventuality, rather than doing damage control and dealing with the fallout after a breach.

To be prepared, a breach response plan should be established, detailing which teams will take action in the event of a breach to inform affected clients, respond to the media, and block the intruder and eliminate the weakness that led to the breach. What are some of the basic elements of an incident response plan? Here are a few critical components every plan should include.

Information Inventory

Keep detailed information on what data the company collected, processed, and stored, where that information is stored, and access privileges. Prioritize the data according to sensitivity, compliance requirements, and total damage that could be done if lost. If your storage plan includes the cloud, specify where those servers are located, what protections are in place, and who has access to the data stored there.

Monitor Access/Audit

data breaches NJIT departments usually carry out monitoring processes, but the breach response plan should include procedures on monitoring access and completing audits. Many organizations fail to completely remove old accounts or compartmentalize data access.

Be Aware of Compliance Requirements

Healthcare and financial services information assurance are heavily monitored. Stay informed on what regulations exist that affect company data and audit the procedures regularly to ensure continued compliance with changing laws. Make sure all requirements and recommended steps are covered in a response plan.

Assess Your Legal Risks

Data breaches can lead to long, expensive class-action lawsuits. Include in a response plan a list of contracted legal agencies that specialize in breach response so a company can activate their teams immediately.

Establish a Crisis Communication Plan

By far the most important element of a response plan. Clear chains of communication will eliminate confusion and ensure each party knows exactly what they need to know. Any teams and assigned leaders from various departments that play a role in the internal and external communication processes should be included. If a company employs an outside agency to handle external communications (e.g., drafting/sending letters, press conferences, informing law enforcement agencies, etc.) following a breach, list these on the plan and clearly identify how that agency will be contacted.

Practice Incident Response Plans

A successful response plan relies on team members and any third-party agencies knowing their roles and being able to execute them correctly. For this to happen, incident response plans should be practiced regularly, especially communication procedures. This is especially important after an update to the response plan. Repetition helps team members internalize their roles, turning responses into automatic actions.

A successful response requires planning, attention to detail, informed team members, clear lines of communication, and constant vigilance. A response team that knows their roles, and practices the procedures, is a team that will succeed. While data breaches will remain a risk, being prepared remains the best defense, and that depends on having the right response plan in place.

Contact Us

Don’t let your data fall into the wrong hands, contact us today.

Additional Resources:
https://www.ftc.gov/news-events/blogs/business-blog/2016/10/responding-data-breach
https://www.ftc.gov/system/files/documents/plain-language/pdf-0154_data-breach-response-guide-for-business.pdf
https://usa.visa.com/dam/VCOM/global/support-legal/documents/responding-to-a-data-breach.pdf
http://ptac.ed.gov/sites/default/files/checklist_data_breach_response_092012.pdf
http://www.prim.osd.mil/cap/cio-ia.html
https://www.forbes.com/sites/allclearid/2015/08/27/the-first-three-things-to-do-in-a-data-breach-response/#1964e735b53e
https://www.tripwire.com/state-of-security/security-data-protection/cyber-security/the-right-way-to-respond-to-a-data-breach/
https://www.dlapiper.com/~/media/Files/Insights/Publications/2015/04/Cyberdata_breach_response_checklist_V7.pdf
http://www.lindquist.com/portalresource/LindquistDataBreachGuide.pdf
https://www.stoutadvisory.com/insights/article/practical-steps-responding-data-breach  

 

ransomware attacks on law firms