{"id":25948,"date":"2022-12-06T17:32:13","date_gmt":"2022-12-06T22:32:13","guid":{"rendered":"https:\/\/abovethelaw.com\/?p=915925"},"modified":"2022-12-06T17:32:13","modified_gmt":"2022-12-06T22:32:13","slug":"holidays-and-weekends-prime-time-for-cyberattacks","status":"publish","type":"post","link":"https:\/\/abovethelaw.com\/legal-innovation-center\/2022\/12\/06\/holidays-and-weekends-prime-time-for-cyberattacks\/","title":{"rendered":"Holidays And Weekends: Prime Time For Cyberattacks"},"content":{"rendered":"

\"\"Ed. note<\/u>: This is the latest in the article series, Cybersecurity: Tips From the Trenches<\/strong>,<\/em> by our friends at Sensei Enterprises<\/a>, a boutique provider of IT, cybersecurity, and digital forensics services.<\/em><\/p>\n

Did Your Law Firm Survive Thanksgiving?<\/strong>
\nWe\u2019re happy to say that our company survived \u2013 but we were attacked over 400 times between shutting the office down on Wednesday evening and Thursday morning. All of the attacks originated from IP addresses registered to Microsoft (are you addressing this, Microsoft?).<\/p>\n

Did we get a good night\u2019s sleep that Wednesday? Sure. Good preparation for attacks means that, if the attack is unsuccessful, you don\u2019t get alerts. We learned of all the attacks first thing Thanksgiving morning, with a full report to review over our morning coffee.<\/p>\n

Don\u2019t think we\u2019re cocky about \u201cwinning\u201d the battle. No one is immune from cyberattacks, no matter how good their defenses are. We regard it as being both well-prepared \u2013 and lucky.<\/p>\n

But it did occur to us, with Christmas and New Year\u2019s on the way, that it was time to underscore to law firms something that should be obvious: Cybercriminals don\u2019t go on holiday! Quite the reverse.<\/p>\n

Shore Up Your Law Firm Defenses: Scary Stats<\/strong>
\nThe week before Thanksgiving, cybersecurity firm Cybereason published the results of its recent survey<\/a>. Understandably, more than a third of respondents reported that it took longer for their organization to assess, stop and recover from a cyberattack on a holiday or weekend attack as opposed to a weekday. The larger the organization, the longer the delay.<\/p>\n

Entities also lose more money because of those attacks, which are primarily ransomware attacks. The root of the problem is that so many victims are understaffed on weekends and holidays. Half of respondents reported being staffed at levels below 33%. 20% of companies cut security staffing by 90% from normal weekday levels.<\/p>\n

This gives attackers more time to avoid detection, do more damage and exfiltrate more data as these understaffed security teams scramble to respond.<\/p>\n

Cyber Pros Buckle Up, Worried About a Visit from The Grinch<\/strong>
\nIt has now been many years that cyber pros have been battling holiday-related attacks, so most of them are understandably on edge these days \u2013 and they lack the power to demand that staffing be maintained at normal or close to normal levels.<\/p>\n

When Santa comes this year, all these experts know that hackers will not be far behind. History is our guide: From the Aurora attacks on Google in 2009 to the more recent Log4J and SolarWinds attacks, the notable fact is that these attacks took place mostly between Thanksgiving and New Year\u2019s Day.<\/p>\n

No cyber pro worth his or her salt assumes they will be home for the holidays.<\/p>\n

A Gift of Ransomware for the Holidays?<\/strong>
\nYeah, not much of a gift, but one that seems to be ever-increasing. In 2021 there was a 70% increase in ransomware attacks in November and December compared to January and February.<\/p>\n

So, what is a law firm to do? The best advice these days comes from the Cybersecurity and Infrastructure Security Agency (CISA), part of the Department of Homeland Security. Its advice, well worth taking, has been updated for 2022.<\/p>\n

Here are, verbatim, some of the tips that are integral to preventing and fighting weekend and holiday attacks. Law firm management should talk to their in-house or outsourced cybersecurity professionals to make sure all of these steps are in place.<\/p>\n

\u201cUnderstand the IT environment\u2019s routine activity and architecture by establishing a baseline. By implementing a behavior-based analytics approach, an organization can better assess user, endpoint, and network activity patterns. This approach can help an organization remain alert on deviations from normal activity and detect anomalies. Understanding when users log in to the network\u2014and from what location\u2014can assist in identifying anomalies. Understanding the baseline environment\u2014including the normal internal and external traffic\u2014can also help in detecting anomalies. Suspicious traffic patterns are usually the first indicators of a network incident but cannot be detected without establishing a baseline for the corporate network.<\/em><\/p>\n