Confidentiality is the foundation of the attorney-client relationship. As both an ethical obligation and common-law duty, law firms are trusted guardians of some of the most private and sensitive information. Additionally, there are usually contractual and regulatory requirements at play. With so much information and correspondence digitized, and the ever-evolving strategies of cyber crime, new and continuous approaches to securing the privileged information law firms are privy to is vital.
The American Bar Association reports that in 2021, twenty-five percent of law firms were victims of a data breach. Further, survey results also show that too many law firms, particularly smaller firms, are behind the curve when it comes to establishing basic security measures. To understand what law firms are up against when it comes to cyber crime, let’s take a look at a few of the top security risks law firms face.
Ransomware Attacks: Cyber criminals know that law firms possess large amounts of financial information, private data and intellectual property, making them a tempting ransomware target. Ransomware is usually downloaded onto a computer via a malicious link or file that appears innocent to the victim. Once downloaded, attackers are enabled to access and then encrypt sensitive data and information. Utilizing threats and scare tactics the information is held hostage, until you pay up. This tactic often works against law firms because the release of confidential information can result in even further financial damage, loss of reputation and malpractice suits from clients. To avoid the potential loss of critical files due to ransomware, it is imperative that law firms invest in disaster recovery that includes backing up all crucial information through an external hard drive or at a secure out of network location.
Phishing Scams: Phishing scams are one of the most common attacks on law firms. Criminals use social engineering tactics to try to gain access to sensitive data and/or obtain monetary benefit. Often this is done through a fraudulent email that appears to come from a legitimate source such as a colleague, client or superior. The email tricks the target into sharing financial or personal information, or clicking on a link that installs malware.
Malware:A malware attack is when malicious code is used to infiltrate networks and databases in order to steal or destroy sensitive data. Often this is done through viruses or trojans that are accidentally downloaded through spam emails, malicious links or from an infected computer in the same network. These attacks are only increasing due to so much work being done by employees remotely on a variety of devices. To ward off malware, it is important that all employees take advantage of software updates in a timely manner as they often include security upgrades and patches.
Access Control & Authentication: Relying on weak and easily guessed passwords is an issue with many users, and law firms are no exception. This means making sure employees are creating passwords that appropriately protect the network. Additionally, too often too many users have access to more than necessary on a network, so it’s important to control which users have access to what data along with tracking logins to ensure credentials are being used appropriately. Tools like password manager and multi-factor authentication can prevent bad actors from getting into your network.
Lack of Training: Most data breaches involve some sort of human error, and attorneys are experts of the law, not cyber security. Therefore, it’s important to make sure the technology users at your firm are familiar with at least the basics of cyber security. Educating all users about phishing, social engineering, the importance of strong passwords, necessity of updating software and overall remaining vigilant is imperative. This gives users more confidence, and clients a greater sense of trust.
Law firms are well-known stewards of private and sensitive information, making them frequent targets of cyber attacks. Small firms too often fall victim since many have not invested in the defenses and procedures necessary to head off a breach. Fortunately, the financial stability and reputation of a firm can be protected with some simple security measures to ward off the above top risks. To ensure that the cornerstone of confidentiality between you and your clients is protected, don’t allow a lack of basic cyber security to wreak havoc on your firm.
Whatever size your business, cyber criminals love to find flaws in your systems to exploit. In fact, small businesses are usually more at risk because they generally don’t have the time, staff and resources of a larger company. Unfortunately, cyber criminals are well aware of this susceptibility. Your network, operating system, processes and even (especially!) you and your employees all have potential vulnerabilities that can be taken advantage of and used, often for monetary gain, at the expense of your small business.
Being aware of potential vulnerabilities is key to thwarting an attack. To be clear, these are weaknesses that potentially exist within your own system that could be used against you. The bright side? This means you have the power to seek out and fix these flaws before someone else finds them first. Let’s take a look at the four main areas for potential vulnerabilities.
Network Vulnerabilities are issues with hardware or software that could attract an intruder. Examples include outdated or unpatched software applications, insecure Wi-fi access points and poorly configured firewalls.
Operating System (OS) Vulnerabilities are exposures within an OS that criminals can use to create havoc or cause damage. Examples include default superuser accounts and hidden backdoor programs.
Process Vulnerabilities are when procedures are supposed to act as security, but in reality are insufficient. Common ones are weak passwords and utilizing only single factor authentication.
Human Vulnerabilities are our own missteps, which are incredibly common. User errors often involve opening infected links and not installing software updates on mobile devices in a timely manner.
Left unchecked, any of these vulnerabilities can be discovered and exploited by cyber criminals, resulting in an actual attack. Today, this usually means malware attacks (ransomware, viruses, spyware, etc.), social engineering attacks (phishing, pharming, spam, etc} and password hacking. While attacks are usually for monetary gain, they often not only result in loss of assets, but can weaken an organization’s reputation, damage the trust of your clients, and ultimately lead to loss of customers or even your entire business.
There is no way to have a completely vulnerable-free system as our technology landscape is ever growing, changing and connecting, but there are certainly ways to lessen risk. Luckily some of the vulnerabilities above can certainly be addressed easily within your own organization (stronger passwords, people!). That being said, a risk assessment performed by cyber security experts is still your best bet for finding and removing vulnerabilities, before someone else finds them first.
Reliance on the incredible advancements in technology translates to unprecedented conveniences and greater efficiency for today’s small businesses, but it also means new vulnerabilities. Your company’s private information, assets and customer data now have the potential to be hijacked and accessed by bad actors in unique and ever-evolving ways.
For many small business owners, unless tech savvy and on top of the latest threats, this is often coupled with the fact that you’re in what can sometimes be an intimidating and confusing terrain – the digital world. Cybersecurity is now one of the best prevention tools for avoiding headaches and even disaster for your small business.
Cybersecurity is the overarching term for a variety of methods used to protect your digital information. Cybersecurity has three major objectives: confidentiality (only authorized users have data access), integrity (trustworthiness and veracity of data) and availability (accessible data where and when users need it), otherwise known as the CIA Triad. These three pillars are the guiding framework for protecting your digital information, and what directs any IT company when considering a small business’s specific cybersecurity needs.
Furthermore, there are several areas to think about, much of it focused on prevention, when considering a business’s cybersecurity:
Network Security – a layered approach designed to protect your computer network from targeted attacks or malware
Application Security – keeps software and devices secure. Ideally, security should be built into the initial design of all software and applications
Information Security – protects data while it’s both stored and en route
Operational Security – secures data during all processes, permissions and procedures
Disaster Recovery and Business Continuity – response to a breach. Disaster Recovery is how a business restores operation and information in order to return to the same capacity as prior to the incident. Business Continuity is how an organization runs while trying to operate without certain resources due to the attack
End-user Education – teaching users how to avoid accidentally triggering an attack by helping them learn to identify suspicious email attacks, USB drives, and more
Why Do Small Businesses Need Cybersecurity?
Too many small businesses have a false sense of security due to relying on a comfortable feeling of anonymity, as compared to a large company. Unfortunately, attackers are increasingly automating attacks that can harm thousands of small businesses at once no matter how “anonymous” you think your company might be.
In reality, cyber attacks are more common for small businesses than large companies. About 47% of small businesses experience an attack each year (HISCOX). The main reason being that most small businesses generally don’t have the time and resources of a larger company at their disposal, leaving them more susceptible to an attack. Small businesses normally don’t have the security infrastructure of a large company, but still have data cyber criminals desire, and cyber criminals are well aware of this vulnerability.
What are the risks associated with cybersecurity in small businesses?
For a small business, the consequences are also often greater. Cyber attacks can have devastating consequences on a small business. Leading to loss of money, trust, reputation, clients, and the list goes on.
In fact, many small businesses are unable to survive an attack. 60% of small businesses that are victims go out of business within six months (Denver Post). Additionally, the average financial cost to a small business is not minor at $25,612 (HISCOX).
Cybersecurity Tips for Small Businesses
With these consequences in mind, it’s important to consider any step you can take to increase your cybersecurity.
Some general steps include keeping your software and operating system updated as that ensures the most recent security patches, installing anti-virus software, using strong passwords, avoiding opening any unusual attachments or links, and avoiding using unsecure WiFi in public places. Finally, consider using some of your budget to invest in professional cyber security guidance, installation and training from a reputable IT company.
In today’s tech landscape, for a small business to grow and thrive, cybersecurity is essential to protecting its future.