{"id":30510,"date":"2024-05-17T16:46:37","date_gmt":"2024-05-17T20:46:37","guid":{"rendered":"https:\/\/abovethelaw.com\/?p=1017222"},"modified":"2024-05-17T16:46:37","modified_gmt":"2024-05-17T20:46:37","slug":"legal-tech-lists-7-ways-law-firms-invite-a-breach","status":"publish","type":"post","link":"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/","title":{"rendered":"\u2018Legal Tech Lists\u2019: 7 Ways Law Firms Invite A Breach"},"content":{"rendered":"

\"binary-3441010_1280\"Editor\u2019s note:<\/span> This is an installment in the \u201cReference Manual of Legal Tech Lists Vol. II,\u201d an eBook set for release this summer.<\/em><\/span><\/p>\n

It’s been a very bad year for law firms.\u00a0<\/span><\/p>\n

Not only were many law firms breached \u2014 and some from BigLaw \u2014 but the class action attorneys also have apparently discovered there is money to be made from class action lawsuits against breached law firms.<\/span><\/p>\n

It seemed like a good time to talk about foolish things that law firms and lawyers do that amount to an engraved \u201cbreach me\u201d invitation to cybercriminals.<\/span><\/p>\n

No. 1: They Don\u2019t Adopt Multifactor Authentication (MFA)<\/b><\/p>\n

As all lawyers know, there is an inconvenience factor to adopting MFA.\u00a0<\/span><\/p>\n

And an amazing number of lawyers resist the very minor inconvenience of having to authenticate themselves twice, first entering their password (something they know) and then authenticating again via something they have (i.e. an app on their phone) or using biometrics.<\/span><\/p>\n

According to Microsoft, the adoption of MFA will prevent 99.9% of account takeovers. We have seen multiple law firms refuse MFA (groaning about its inconvenience) only to suffer account takeovers. They sure were anxious to adopt MFA after the breach. D\u2019oh.<\/span><\/p>\n

No. 2: They Don\u2019t Have Multiple Backups<\/b><\/p>\n

Most importantly, you must have more than one backup \u2014 and one of the backups should not be connected to your network.\u00a0<\/span><\/p>\n

The first thing cybercriminals will do after breaching your network is to break into any accessible backups so you cannot recover from the breach without paying the ransom.\u00a0<\/span><\/p>\n

Also, make sure your cloud backup has multiple versions and doesn\u2019t only sync the contents of the local backup. Encrypting the local backup shouldn\u2019t replicate so that your cloud backups are encrypted too.<\/span><\/p>\n

It is also important to recognize that, while having your data in the cloud is not a guarantee that you won\u2019t be breached, your data is infinitely safer in the cloud. While there have been cloud breaches, MOST of them have happened because an employee of yours misconfigured something in the cloud.\u00a0<\/span><\/p>\n

We\u2019re down to only two clients who have their data on-premise \u2014 one is stubborn \u2014 and we feel for the other because that law firm is commanded by a major client to have the data onsite.<\/span><\/p>\n

The cloud is where it\u2019s all happening these days.\u00a0<\/span><\/p>\n

If you cling to the past, you do yourself no favors \u2014 and note that some IT folks will encourage staying with an on-premise solution because they make more money that way.<\/span><\/p>\n

No. 3: They Skimp on Employee Training<\/b><\/p>\n

Law firm employees are your first line of defense. Endless phishing emails (which have gotten more sophisticated thanks to artificial intelligence) and social engineering are dire threats.\u00a0<\/span><\/p>\n

So why wouldn\u2019t you train employees to recognize these kinds of attacks \u2014 and offer them as many different examples as possible of those attacks and others?\u00a0<\/span><\/p>\n

And yet most law firms, particularly the solo\/small\/midsized firms, do not offer this training.<\/span><\/p>\n

The cost of an annual cybersecurity training online session is modest \u2014 the cost of a data breach is immense.\u00a0<\/span><\/p>\n

Tip: get a reference from a fellow lawyer about cybersecurity firms who do good employee training at a reasonable fee.<\/span><\/p>\n

No. 4: They Don\u2019t Have An Adequate Plan\u00a0<\/b><\/p>\n

An incident response plan (IRP) may salvage your firm in the event of a breach, and yet only 42% of firms have one.\u00a0<\/span><\/p>\n

And we\u2019re pretty sure that many of the IRPs that do exist are either outdated or not quite up to snuff. Get some help from a cybersecurity professional who is accustomed to drafting these plans.<\/span><\/p>\n

Minus a thorough plan, after a breach you will haplessly do all sorts of things that are wrong, done in the incorrect order, etc.\u00a0<\/span><\/p>\n

Remember, there are penalties (lots of them) for not handling a breach correctly and reporting it timely. And did we mention the ethics rules?<\/span><\/p>\n

No.5: They Trust Without Verifying<\/b><\/p>\n

Don\u2019t trust your employees. Why?\u00a0<\/span><\/p>\n

Because they take your data when they go to another firm.\u00a0<\/span><\/p>\n

You see that in the headlines regularly. You also often see law firm bookkeepers embezzle money. Just do a search and you will see the necessity of having someone audit your books.<\/span><\/p>\n

Hopefully, you do not allow sharing of passwords. But employees do it anyway.\u00a0<\/span><\/p>\n

The usual excuse is that, for instance, a lawyer and a paralegal need to have access to one another\u2019s email. If one is compromised, both are compromised. Enforce your policy!<\/span><\/p>\n

When you need a security assessment, do NOT let your IT folks do it. They have a vested interest in the outcome.\u00a0<\/span><\/p>\n

We could go on, but you get the idea. To adapt Ronald Reagan\u2019s words, \u201cif you <\/span>must<\/b> trust, then verify.\u201d<\/span><\/p>\n

No. 6: They Take Their Work Laptop Abroad<\/b><\/p>\n

If you take your work laptop abroad, you take your chances. Some countries are more dangerous than others.\u00a0<\/span><\/p>\n

We have seen a video of a laptop left in a hotel room in China and watched as two men entered the lawyer\u2019s room and downloaded the entire contents of the laptop.<\/span><\/p>\n

Mind you, not every country is as dangerous as China when it comes to coveting a lawyer\u2019s data.\u00a0<\/span><\/p>\n

But routinely, large firms have clean laptops that they loan out for trips abroad.\u00a0<\/span><\/p>\n

For small firms, the cost of an extra laptop or two is well worth it. Make sure you make this a law firm policy requirement.<\/span><\/p>\n

Remember the post roll call words of police Sgt. Phil Esterhaus on Hill Street Blues? \u201cLet\u2019s be careful out there.\u201d Those words apply here \u2013 and there may be ethical implications as well.<\/span><\/p>\n

No. 7: They Let Apps Access Their \u2018Contacts\u2019<\/b><\/p>\n

We routinely see lawyers do this.\u00a0<\/span><\/p>\n

MANY apps ask for access to your \u201cContacts,\u201d and the average lawyer simply allows it.\u00a0<\/span><\/p>\n

What are they thinking???? Your \u201cContacts\u201d contain all kinds of sensitive data \u2014 and the integrity of most apps is highly questionable. Many sell data.<\/span><\/p>\n

Several bars have already said it is unethical to allow apps to access your \u201cContacts.\u201d And they are right!<\/span><\/p>\n

This list could go on and on, but following the advice above should upgrade your cybersecurity significantly!\u00a0<\/span><\/p>\n

\n

Sharon D. Nelson<\/i> is a practicing attorney and the president of Sensei Enterprises, Inc. She is a past president of the Virginia State Bar, the Fairfax Bar Association and the Fairfax Law Foundation. She is a co-author of 18 books published by the ABA. <\/i>snelson@senseient.com<\/i><\/a><\/strong><\/p>\n

John W. Simek<\/i> is vice president of Sensei Enterprises, Inc. He is a Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH) and a nationally known expert in the area of digital forensics. He and Sharon provide legal technology, cybersecurity and digital forensics services from their Fairfax, Virginia firm. <\/i>jsimek@senseient.com<\/i><\/a><\/strong><\/p>\n

Michael C. Maschke<\/i> is the CEO\/Director of Cybersecurity and Digital Forensics of Sensei Enterprises, Inc. <\/i>\u00a0<\/i>He is an EnCase Certified Examiner, a Certified Computer Examiner (CCE #744) a Certified Ethical Hacker and an AccessData Certified Examiner. He is also a Certified Information Systems Security Professional. <\/i>mmaschke@senseient.com<\/i><\/a><\/strong><\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

We fall back on the words of Forrest Gump: \u2018Stupid is as stupid does.\u2019<\/p>\n","protected":false},"author":136517,"featured_media":1017225,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[11],"tags":[102,22,1292,112,7],"class_list":["post-30510","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology","tag-biglaw","tag-in-house-counsel","tag-legal-operations","tag-small-law-firms","tag-technology"],"acf":[],"yoast_head":"\n\u2018Legal Tech Lists\u2019: 7 Ways Law Firms Invite A Breach - Above The Law's Legal Tech Non-Event<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u2018Legal Tech Lists\u2019: 7 Ways Law Firms Invite A Breach - Above The Law's Legal Tech Non-Event\" \/>\n<meta property=\"og:description\" content=\"We fall back on the words of Forrest Gump: \u2018Stupid is as stupid does.\u2019\" \/>\n<meta property=\"og:url\" content=\"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/\" \/>\n<meta property=\"og:site_name\" content=\"Above The Law's Legal Tech Non-Event\" \/>\n<meta property=\"article:published_time\" content=\"2024-05-17T20:46:37+00:00\" \/>\n<meta name=\"author\" content=\"Jeremy Barker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jeremy Barker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/\",\"url\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/\",\"name\":\"\u2018Legal Tech Lists\u2019: 7 Ways Law Firms Invite A Breach - Above The Law's Legal Tech Non-Event\",\"isPartOf\":{\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/#primaryimage\"},\"thumbnailUrl\":\"\",\"datePublished\":\"2024-05-17T20:46:37+00:00\",\"dateModified\":\"2024-05-17T20:46:37+00:00\",\"author\":{\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/#\/schema\/person\/0778e2cda6d4b3d4386a62e82fc8adca\"},\"breadcrumb\":{\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/#primaryimage\",\"url\":\"\",\"contentUrl\":\"\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u2018Legal Tech Lists\u2019: 7 Ways Law Firms Invite A Breach\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/#website\",\"url\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/\",\"name\":\"Above The Law's Legal Tech Non-Event\",\"description\":\"A Legal Tech Adoption Guide For Perplexed Lawyers\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/#\/schema\/person\/0778e2cda6d4b3d4386a62e82fc8adca\",\"name\":\"Jeremy Barker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/ebbef652bed141f4b7c93113fd26e98b428c48fee7b99bc412612c7053564515?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/ebbef652bed141f4b7c93113fd26e98b428c48fee7b99bc412612c7053564515?s=96&d=mm&r=g\",\"caption\":\"Jeremy Barker\"},\"description\":\"Jeremy Barker is the director of content marketing for Breaking Media. He has been a writer and editor in the legal industry for more than a decade, holding varied roles at Law360, American Lawyer Media, and a Manhattan law firm. Please feel free to email him with any questions or comments and to connect on LinkedIn.\",\"url\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/author\/jbarker\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u2018Legal Tech Lists\u2019: 7 Ways Law Firms Invite A Breach - Above The Law's Legal Tech Non-Event","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/","og_locale":"en_US","og_type":"article","og_title":"\u2018Legal Tech Lists\u2019: 7 Ways Law Firms Invite A Breach - Above The Law's Legal Tech Non-Event","og_description":"We fall back on the words of Forrest Gump: \u2018Stupid is as stupid does.\u2019","og_url":"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/","og_site_name":"Above The Law's Legal Tech Non-Event","article_published_time":"2024-05-17T20:46:37+00:00","author":"Jeremy Barker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Jeremy Barker","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/","url":"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/","name":"\u2018Legal Tech Lists\u2019: 7 Ways Law Firms Invite A Breach - Above The Law's Legal Tech Non-Event","isPartOf":{"@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/#website"},"primaryImageOfPage":{"@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/#primaryimage"},"image":{"@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/#primaryimage"},"thumbnailUrl":"","datePublished":"2024-05-17T20:46:37+00:00","dateModified":"2024-05-17T20:46:37+00:00","author":{"@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/#\/schema\/person\/0778e2cda6d4b3d4386a62e82fc8adca"},"breadcrumb":{"@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/#primaryimage","url":"","contentUrl":""},{"@type":"BreadcrumbList","@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/2024\/05\/17\/legal-tech-lists-7-ways-law-firms-invite-a-breach\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/abovethelaw.com\/legal-innovation-center\/"},{"@type":"ListItem","position":2,"name":"\u2018Legal Tech Lists\u2019: 7 Ways Law Firms Invite A Breach"}]},{"@type":"WebSite","@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/#website","url":"https:\/\/abovethelaw.com\/legal-innovation-center\/","name":"Above The Law's Legal Tech Non-Event","description":"A Legal Tech Adoption Guide For Perplexed Lawyers","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/abovethelaw.com\/legal-innovation-center\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/#\/schema\/person\/0778e2cda6d4b3d4386a62e82fc8adca","name":"Jeremy Barker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/ebbef652bed141f4b7c93113fd26e98b428c48fee7b99bc412612c7053564515?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/ebbef652bed141f4b7c93113fd26e98b428c48fee7b99bc412612c7053564515?s=96&d=mm&r=g","caption":"Jeremy Barker"},"description":"Jeremy Barker is the director of content marketing for Breaking Media. He has been a writer and editor in the legal industry for more than a decade, holding varied roles at Law360, American Lawyer Media, and a Manhattan law firm. Please feel free to email him with any questions or comments and to connect on LinkedIn.","url":"https:\/\/abovethelaw.com\/legal-innovation-center\/author\/jbarker\/"}]}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/posts\/30510","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/users\/136517"}],"replies":[{"embeddable":true,"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/comments?post=30510"}],"version-history":[{"count":0,"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/posts\/30510\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/"}],"wp:attachment":[{"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/media?parent=30510"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/categories?post=30510"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/tags?post=30510"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}