![\"young](\"https:\/\/www.infolaw.co.uk\/newsletter\/wp-content\/uploads\/2016\/05\/Shocked-Girl-Cyber-Crime.jpg\")
<\/p>\n<\/p>\n
Most legal practices have yet to get to grips with the idea of \u201ccyber resilience\u201d but it is a strength that they urgently need to acquire now. Only then can a legal practice develop and deliver new IT-supported service propositions that can add significant value to services for clients, introducers and business partners.<\/p>\n
The increasingly high profile threat of security breaches, such as the attack on Mossack Fonseca and extensive breaches reported more widely in the legal sector, are holding many back from introducing innovative working practices that can improve their performance and future prospects.<\/p>\n
It shouldn\u2019t be that way. Law firms need to become confident that they are as safe and secure as they can be, understanding the risks and knowing the boundaries that can\u2019t be crossed, but at the same time, pushing their deployment of IT up to safe margins within those limits.<\/p>\n
Unfortunately, many of the fears about potential breaches of data security and confidentiality are justified.<\/p>\n
Just like risk management generally, many of the steps needed to minimise risk have to be applied widely across the practice, requiring personal compliance with rules and collaboration across internal departments. This is not just an issue for the IT team, although they have a significant role to play.<\/p>\n
Resilience is not just about preventing cyber crime, <\/em>but encompasses cyber security<\/em> on many fronts.<\/p>\n A cyber-resilient law firm should \u201chave the capacity across the business to maintain their core purpose, operations and integrity in the face of cyber attacks and cyber security breaches. A cyber-resilient practice is one that can prevent, detect, contain and recover from a plethora of serious threats against data, applications and IT infrastructure. It successfully aligns continuity management and disaster recovery with security operations in a holistic fashion.\u201d<\/p>\n The threats are real. Just like the risk of a break-in or a fire, there should be an assumption that it is inevitable. Something serious will happen someday \u2013 so prepare for it now.<\/p>\n The concern is that lawyers are generally just not doing much of what needs to be done to minimise cyber risks when doing this effectively would enable them to be more innovative in their use of IT within defined boundaries.<\/p>\n Many lawyers are not exploring new tools to improve business operations or support new ways of servicing clients because they fear, but don\u2019t fully understand, what cyber risks they face; and how or to what extent they can be managed.<\/p>\n The challenges here are nothing new. Stand up those of us who have sent at least one email to the wrong person? Not too many people left seated I am guessing! How many firms have innocently sent completion money to the wrong firm or client? Too many, but both of these cyber breaches are generally down to human error.<\/p>\n Feedback from research reported in \u201cThe Cyber Resilient Organisation in the United Kingdom: Learning to Thrive against Threats<\/a>\u201d, conducted by Ponemon Institute LLC, in January 2016, reinforces the global picture of the source of risks. Conclusions here apply as much to law firms (with confidential client and transaction data and routine financial transactions at risk) as to other data-sensitive business sectors like banking.<\/p>\n 1) Employees and negligence are the leading cause of security incidents but remain the least reported issue. According to research reported in the 2015 Experian Annual Data Breach Industry Forecast, this represented 59 per cent of security incidents in the last year. They conclude that policies and processes to prevent cyber breaches are still not taken seriously enough and that employee training programs to support them have not been high enough on the agenda, suggesting that this will continue to be a source of future breaches.<\/p>\n 2) Persistent attacks have the second greatest impact. They are less likely to occur, but frequency is certainly increasing for law firms. Do you have tools to help identify attempts to breach your security?<\/p>\n 3) Third-party glitches in software are common but are not perceived as likely to have the highest impact on cyber resiliency. How extensively are your software applications scrutinised for frailties here? To test apps for common vulnerabilities, check out resources like, for example www.owasp.org<\/a>.<\/p>\n One particular area worth exploring in law firms relates to risks around the increasingly routine use of hosted and cloud-based IT applications. We are keen to help law firms adopt the cloud as they can significantly improve and streamline lawyers\u2019 access to and use of information to help manage and process their work. However, they should only be used if security can be assured.<\/p>\n This warning from the head of a major supplier of cloud-based solutions for law firms in the UK reflects the concerns we hear in the sector: that lawyers just haven\u2019t been paying enough attention to the risks:<\/p>\n \u201cFor law firms, the challenge is that they are trying to weigh up the costs of implementing solutions against the perceived threat and the value the firm will receive. This is difficult for partners to understand, so decisions don\u2019t get made. However, one breach could bring down the whole firm. One of the big areas of concern in my opinion is the education of staff and their understanding of security not only in terms of IT security, but also for Professional Indemnity Insurance \u2013 it is a long road but the journey really does need to start.\u201d<\/p>\n Most firms use some hosted or cloud services, but not many evaluate (and then minimise) the risks involved in using these applications \u2026 all of which we are keen to get lawyers using. Examples of hosted and cloud applications now used routinely in legal practices include business Intelligence, conveyancing searches, online case management, online CRM, web content management systems, VoIP for telephone systems, online HR, performance management, DropBox and online document management extending to fully hosted practice management systems.<\/p>\n Convincing recent research reported in \u201cCloud Security Temperature Check: A question of visibility, governance and management<\/a>\u201d a Freeform Dynamics Inside Track Research Note, May 2015 confirms key risks as:<\/p>\n The first priority is to ensure that the leaders of the business recognise the risks of potential breaches of information security and take those risks seriously. This requires them to set the tone and to take a lead as advocates for discipline in managing information, which they must practice too.<\/p>\n They must deal themselves in; and then introduce the following steps.<\/p>\n 1) Plan and prepare for an incident. To contribute to that, evaluate potential for breaches \u2013 confidentiality, integrity, or availability (but apply to on-premise too) 3) Give one function or department within the firm responsibility for ensuring resilience. Within that, enable efficient and effective back up procedures and business continuity.<\/p>\n 4) Train key people to understand, communicate and police the risks<\/p>\n 5) Develop collaboration between teams to ensure good practice is applied widely<\/p>\n 6) Know what data is in the Cloud, identify the sensitivity (personal data, price sensitive data etc.) and evaluate risks<\/p>\n 7) Establish clear policies on mobile device and communications as technologies that enable control over insecure mobile devices (including BYOD) are critical security hazards. Indeed, it has been said that \u201cthe risks are \u2026 wherever your people are.\u201d<\/p>\n 8) Carry out challenging penetration and vulnerability testing.<\/p>\n 9) Improve, monitor and enforce routine operations that impact. For example: protect passwords and require effective updates; use https, encrypt data, emails and attachments; and only notify passwords by SMS or letter.<\/p>\n 10) Consider formalising systems by implementing ISO27001<\/a>. A good start would be to buy a copy of the standard itself to see what compliance entails. It would also give good guidance on what steps you should take and whether or not you intend to go for formal certification.<\/p>\n Allan Carton is Managing Director at Inpractice<\/a>, advising lawyers on client-led initiatives to introduce IT to develop the business. Email acarton@inpractice.co.uk<\/a>. Twitter @AllanCarton<\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" Most legal practices have yet to get to grips with the idea of \u201ccyber resilience\u201d but it is a strength that they urgently need to acquire now. Only then can a legal practice develop and deliver new IT-supported service propositions that can add significant value to services for clients, introducers and business partners. The need […]<\/p>\n","protected":false},"author":83,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[133],"tags":[],"class_list":["post-3484","post","type-post","status-publish","format-standard","hentry","category-cybersecurity"],"yoast_head":"\r\nWhat are the real cyber risks?<\/h3>\n
Cyber security in the cloud<\/h3>\n
\n
Making it happen<\/h3>\n
\n2) Make all your people (including senior management) aware of the dangers involved and then commit to addressing the risks. Give them clear pictures of how they can get it wrong and what they can to do get it right.<\/p>\n