{"id":25504,"date":"2022-11-01T14:44:44","date_gmt":"2022-11-01T18:44:44","guid":{"rendered":"https:\/\/abovethelaw.com\/?p=909664"},"modified":"2022-11-01T14:44:44","modified_gmt":"2022-11-01T18:44:44","slug":"if-u-s-essential-infrastructure-is-brought-down-is-your-law-firm-prepared","status":"publish","type":"post","link":"https:\/\/abovethelaw.com\/legal-innovation-center\/2022\/11\/01\/if-u-s-essential-infrastructure-is-brought-down-is-your-law-firm-prepared\/","title":{"rendered":"If U.S. Essential Infrastructure Is Brought Down, Is Your Law Firm Prepared?"},"content":{"rendered":"

\"\"Ed. note<\/u>: This is the latest in the article series, Cybersecurity: Tips From the Trenches<\/strong>,<\/em> by our friends at Sensei Enterprises<\/a>, a boutique provider of IT, cybersecurity, and digital forensics services.<\/em><\/p>\n

Can U.S. Critical Infrastructure Really Be Brought Down?<\/strong>
\nThat\u2019s the preliminary question. At one time, and not so long ago, we were not overly worried about our susceptibility to a major takedown of U.S. essential infrastructure. But those days are gone.<\/p>\n

On October 28, the Washington Post reported <\/a>that the United States is highly vulnerable to foreign cyberattacks designed to damage the economy, and needs to do far more to defend against them. This is the conclusion of a think tank report<\/a> from the Foundation for Defense of Democracies.<\/p>\n

The report concludes that our government has a blind spot when it comes to cyber economic warfare that could \u201ccause a catastrophic strategic surprise\u201d and destabilize U.S. critical infrastructure.<\/p>\n

What can we do most effectively? Prepare. And yes, that applies to law firms too.<\/p>\n

Convincing Law Firms of the Problem<\/strong>
\nConvincing law firms about the urgency of this problem would take forever because there is so much evidence, but let\u2019s focus on a few nuggets from the Washington Post article.<\/p>\n

Moscow has proven its ability to use its surveillance dragnet to select U.S. targets. It\u2019s also proven itself very capable of penetrating U.S. critical infrastructure.<\/p>\n

You may recall the SolarWinds 2019 hack by Russia, when attackers penetrated an IT company and broke into the networks of its customers, including nine federal agencies and more than 100 companies. How much better do you think Russian\u2019s assault capabilities are now? The betting money is that they are very, very good.<\/p>\n

Don\u2019t forget about China, which has also proven itself gifted at penetrating U.S. networks. Other, but significantly lesser players, include North Korea and Iran.<\/p>\n

Cyberwar may fall just short of armed conflict, but it could be catastrophic in its impact. While it is often said that the U.S. and its allies must prevent their enemies from becoming more and more able to take down critical infrastructure, there is a clear consensus that we and our allies are not at that point now.
\n
\nLaw Firms Should Hope for the Best but Prepare for the Worst<\/strong>
\nSo, what constitutes critical infrastructure? The Federal Emergency Management Agency (FEMA) says critical infrastructure includes people, assets, systems, and networks, whether physical or virtual, so vital to the United States that their incapacity or destruction will have a debilitating impact on security, the nation’s economy, public health or safety, or a combination of those things.<\/p>\n

The sheer number of disasters is almost unimaginable. But one must begin somewhere. So let\u2019s imagine that the power is out, not just locally but throughout the country. There was a time when we believed that scenario was not possible, but we are a lot less certain now.<\/p>\n

What if all the major banks and Wall Street are taken down? Or the internet, our water systems, hospitals, defense agencies, the military, the federal government, state governments, transportation, major corporations, hospitals? The list goes on and on.<\/p>\n

Defending Against the Unthinkable for Law Firms<\/strong>
\nWe are not going to address the issues faced by the Am Law 100. They have millions of dollars to throw at Incident Response Plans (IRPs) and cybersecurity annually. Not so for the solo\/small\/mid-sized firms. Most of those firms have not yet even addressed hurricanes, tornados, floods, power outages and the like. 60% of law firms lack any IRP according to the American Bar Association\u2019s 2021 survey.<\/p>\n

In the case of a successful attack on our critical infrastructure, your law firm and your clients may face innumerable difficulties. How will you pay your employees if the banks are taken out? If communications are at issue, how will you communicate with your clients and your employees? If your clients are part of the critical infrastructure of the country, what special problems must you be prepared for? If the internet is down, how will you function?<\/p>\n

Disaster Planning: It\u2019s Not Just for Hurricanes<\/strong>
\nThe header above is the title of a recent Legal Talk Network Digital Edge podcast<\/a> author Nelson and co-host Jim Calloway recorded with Shawn Holahan, Practice Management Counsel and Loss Prevention Counsel for the Louisiana State Bar Association. She lived through losing access to her home and her office during Hurricane Katrina in 2005. So she knows a lot about traditional disasters and has continued to evolve her expertise as our world and its dangers have become more complex.<\/p>\n

We suggest listening to the podcast because she includes so many things you will want to include in a law firm incident response plan \u2013 and her advice is spot on. But here are some of the chestnuts that particularly appealed to us (because they are so often ignored).<\/p>\n