There’s a quiet revolution taking place in the legal industry and the pace at which this is happening is gathering serious momentum. Suddenly the legal sector is having to cope and operate as a fully-fledged commercial entity and as such, the technology, processes and regulatory requirements are increasing and Lawyers do not necessarily have the time or skills in house to harness the benefits and opportunities the new era present.

With the above in mind, as a forward thinking firm, here are some of the key areas to embrace as you scale your firm to capitalise on the benefits and opportunities the 21^st Century presents.

Infrastructure Security
Gone are the days when IT Managers and ‘techies’ keeps all their ‘cards’ close to their chest and treat the company’s IT infrastructure as if it’s theirs… and that they are powerful and always in control.

With the evolution of cloud services, virtual desktops, smart-devices, the changing needs of users; IT Managers are slowing watching their control and native powers diluted.  However, all is not lost because the company will always need to have the knowledge on an internal expert at hand.  But on a whole these roles are being transferred to Account Managers within hosting companies and whoever was the IT Manager in a company, are now seeing their roles as either a middle man, a Transition Manager, a Consultant or moving on to other things outside of the legal sector.

Within the infrastructure, the security for most “smart companies” are relatively good, but for the duration of which these IT Managers hold their post, things were relatively secure to a point and at that point, hacking, insider threat and data loss wasn’t a major challenge, maybe the biggest challenge at the time was the huge disconnect with IT and other parts of the business in terms of what can and cannot be bought (hardware, software, fancy gadgets) to propel the business.

Cloud Computing
Cloud security and the term cloud computing has become the buzz word/phrase in the industry nowadays but not many people really understand the concept and the implications to their business.  While it is contoured as very economical financially, sometimes not enough planning and thought process goes into the transition and as such, the true opportunities are not met and in so doing, increases the risks on top of those that were not previous in known or identified whilst inhabiting the traditional computing model.

Three key areas for consideration for Law firms when thinking of transitioning from the traditional technology services model are:

1. Knowing your current risk profile and measure that against the perceived unknown and fit for purpose solution
2. Know who, what, where and how your data, systems are held – within the EU, Outside the EU…
3. Know the laws and compliance requirements of the country
4. Perform regular or on-going audits of your systems

Application Security – Case Management System
Application security is becoming more and more of a concern to organisations due to the capabilities and ‘unknown’ freemium culture; especially those that are uncontrolled and are not necessarily proprietary.  Often times the security within applications are substandard and do don’t meet minimum security standard and if there are security, it is always a bolt on solution rather than security that is built into the SDLC.

Compliance – LEXCEL – ISO22301 – ISO27001 etc.
Never before has compliance, best practices and international standards played such a huge role in the way organisations and their data and IT management operate.  Over the past 6-10 years the increase reliance and demonstrable accountability of companies to comply with standards (competent laws, bribery act, DPA, HIPPA, SOX, PCI-DSS, ISO27001 etc.) is more and more a big business as well as well as being a challenge – practically, financially and strategically.

With the globalisation and the ease at which a small company can compete with a huge multinational, the boundaries for compliance and transparency widens and as such, various accreditations, and compliance requirements comes into the fray where, privacy, security are concerned.

Many Law Firms operate globally and as they cross borders, the burden of compliance adds to the compliance stack they need to address if they plan on expanding and dealing with their ideal multinationals clients.  Some of the international compliance requirements applicable in some of the top developed countries are as follows:

• UK – DPA, BRIBERY ACT, FOI, ISO27001, Acquisition Law, competition Law etc.
• Switzerland – ASIA – US

For any successful expansion in some of the above areas, your firm will need to address and ensure that you tick the box to demonstrate your compliance and that you are deserving of having a place at the international table.

Bring Your Own Device – The Smart-device Explosion
Statistics – ……..

‘Boyd oh boyd’, the headache and challenges that brought the phenomenon in the organisation under the guise of productivity, flexibility but not fit for purpose.  When the smart-device hit the workplace, most CEOs and high flyers executives were the main adapters of this new phenomenon but never really understand the implication of security, compliance and whether or not it will actually be integrated into the existing IT infrastructure.  These poses added challenges of entertaining a ‘bolt-on’ work-around approach to enable CEOs and those with influence to continue to enjoy the status quo of having these devices.

Secure File Sharing – Document Management Security
Time and time again, you see Lawyers with huge suitcases, huge lever arch folders making their way swiftly to court, struggling with highly confidential files and client details. Do you ever imagine for a moment if they were to get mugged by the accused/defendant’s ruthless accomplice, or left it on the train? The market for online sharing and collaboration is growing exponentially at a rate that the industry has never seen before and as this happens, there is great need for more security and protection of the many sensitive files that ‘floats’ across the wires every second as files sizes that are larger than ever before with the support of super fast broadband and connection speeds.

Everything is going online nowadays and only the firm that is forward thinking and serious about growth, profitability and client care will succeed and as such secure online collaboration and the use of these facilities will no doubt enhance the position and strategies of the forward thinking firms.  Even, in some courts nowadays, some Solicitors just turn up and all their casework is at the court house even before they get there ready.  These new approaches to files transfers and the use of technology is becoming more and more prevalent and the awareness of such services and the value it adds to the firm and the client on a whole is enormous but a strategic decision needs to be made not only for the secure file transfer approach but also the secure storage and indexing of scanned documents.  These must be kept secure (encrypted) and with relevant fit for purpose security and compliance controls to mitigate risks via data leakage.

Big data has become a buzzword over the past 2+ years… but who generates more data than a law firm and by extension, HIGHLY confidential data?

One of the many points to consider for Law firms are:

• Secure data sharing facilities
• Data archiving and document management security solution
• Data retention policy and access control
• And finally, last but definitely not least, the security of the enormous amount of data generated and stored by Law firms.

It’s sad to say however, that some Law firms are still on the fence with their transition to move to a robust data and IT platform; which nowadays is a key strategic factor in supporting the growth, strategy and ROI for firms.

Removable Media Security
(Pen Drives/Memory sticks, ipods, CDs)

Proactively Challenge Your Security

Vulnerability scanning / Pen Testing

On-going training and awareness of employees

eLearning, workshops etc.

Insider Threat…The root of all evil when temptations and unfavourable circumstances are over bearing…

Time and time again ‘the Business’ gets panic in a plethora of noise about a new or reincarnated version of malware/botnets. However, whilst we are caught up in the noise/hype, the technical acronyms and the race to get a new fix in, our esteemed internal colleagues are plotting a sly way to steel your treasure – your data.

Insider threat has always been on the radar but the political correctness of organisations tend to be a bit softer and fluffy about the trust of their employees.  On one hand it’s great to have an established view that… I trust all my employees.  However, I am a realist and we must not forget that we live in the real world where data is a strong currency and not everyone who works for you, share your vision and company ethos.

The phrase… keep your friend close and your enemy closer…’ could easily be twisted to say, keep your enemy close and your employee closely monitored’.

Time and time again you see examples of data breach in the news and we wonder why this keeps happening.  Be it deliberate or accidental.

Over the last 12-18 months, there’s been a spate of incidents with household brands such as Morrison’s, The Government and other private entities.  For Morrison’s, lightening struck twice in the same place.  It is a very telling story considering where cybersecurity was in terms of Board level visibility 5-10 years ago.  The board can no longer ignore that fact that they are live targets and it is not a matter of ‘if’, but actually, when do we find out that we have been hacked.  There was a time when most data breach was arising from the public sector and some private sector companies grin quietly as to show their level of investment and robustness.  However, what we are seeing now is a state of humbleness and quiet shuffling of the cards to make strides towards hardening and ensuring that information security is talked about and embedded throughout the organisation.

Whilst most tech savvy and Infosec enthusiast knows or at least acknowledge that cyberwar is currently about firefighting for most companies, it is equally true that some SMEs just do not have the resources, finance or apetite to even start considering defending their business.

However, there are some things that companies can do on their own with ad-hoc or consistent 3^rd party support.  Here are some of the things that can be done to start building a foundation…

• Develop a policy and share it with everyone in the business… discuss the challenges and get feedback to improve as your business evolve
• Help employees to understand the drivers/reasons behind these policies and the importance of adhering to these
• Use software tools as part of the strategy to compliment policies and monitor and updated data security controls as necessary.

So what’s the solution?

Whatever the solution, we will always be human and we will always find a way.  This is always going cut across the people, process and technology landscape…

People

Provide current realistic training and awareness for all employees.  The training should be tailored to team and individual roles.  We cannot over-emphasise the value of good training.  After all, most of or a great proportion of the breaches that occur are human error and are accidental.

Process

This is a very broad area and can be lead to various interpretations.  However in terms of process in this context, I am referring to:

(1) A process to access what is considered privileged data

(2) A process to proactively monitor staff activities to spot trends and spike in behaviour.  Not just random behaviours but long-term persistent activities.

(3) Staff profiling and network (external) connection to outside affiliations that could cause concern by association and the potential for blackmail, bribery etc.

Though the ‘cloud’ has been around for a while now and have gained tremendous momentum, there are still some companies that are still hesitant of the risks whilst others are revelling and basking with the opportunities the cloud presents.

For those companies who are still at cross roads, it’s only a matter of time before they find themselves in a position where the cloud is the only option – be it private cloud or public cloud.

But what are some of the risks this opportunity brings with it?
Let’s not forget, whatever option a company uses, there will always be risks.  It’s just a matter of the size of that company’s risks appetite.

What are some of the controls you can harness to support the protection of data?

Build Platforms With Security in Mind

We use third parties who specialize in securing data because they know way more about it than we ever could. We do what we do well, and we let them focus on what they do well. We also try to design our platforms with data security in mind from the beginning. If the architecture is full of holes from the start, no amount of security is going to help.

Use SSL Certification, Malware Scans, VeriSign

Our website is scanned on a regular basis for malware and other security risks, and we also possess an SSL digital certificate so our customers know our webpages are safe. Our website is also SSL encrypted. Lastly, our website displays the VeriSign seal, which is another way our customers know they can use our website without risk.

Choose Partners Carefully

As a scrappy startup, it’s very easy to find low-cost providers of analytics or customer relationship management (CRM) software. We choose to work closely with name-brand partners. We research the security of those firms and trust them implicitly, given that a lot of the “big guys” — large companies with a lot more to lose — choose them. Invest in security from day one to ensure customer trust.

Plan, Then Create a Backup Plan

Take the most obvious steps in order to ensure the safety of your customers’ data — this includes ensuring all firmware/software is up-to-date, utilizing SSL certificates to encrypt important data transmission and focusing on code security to eliminate potential database and XSS vulnerabilities. Then, create a backup plan in case that fails. Store critical customer data in encrypted formats!
Eliminate Possible Security Problems With Beyond Security

Our e-commerce site accepts large credit card payments daily for big-ticket items, so we understand the importance of protecting our customers’ data. For this imperative task, we use Beyond Security (beyondsecurity.com), a service that performs daily testing on our website to eliminate the possibility of website security problems, like malware, SQL injection and cross-site scripting.

Background

As the advancement in technology grows and the demands for new multifunction devices soar, the fast pace of cloud services soar, the complexities and features grow into an enormous compliance and security nightmare. On the other hand, it can be equally construed that the security issues that accompany these devices are a major cause for Information Security has gained momentum over the years and the pace at which the demand for assurance in Information Security is growing. In addition, it is only natural to face the challenges and tackle the issues that are imminent which posses a threat to the global corporate world of business.

The growth of hackers, numerous malicious software codes and the inevitable zero day exploitation is only getting worse. The way in which enterprises challenge and mitigate these risks is to use all the possible counter measures there are to prove their success or failure in a global dynamic IT environment.

What are the threats in a hosted cloud environment?

The threat landscape is constantly changing. However, some of the most dangerous threats are those that are ‘old school’ with a more sophisticated new approach in launching an Some of the typical threats that are pertinent to cloud services are:

Command Execution

A command string, executed in server-side code, contains invalidated user input

Potential impact

• The attacker can execute arbitrary code using the web server privileges
• This code could retrieve data from the server or directly alter the server

Simple example

• Web user is supposed to provide a filename to be displayed or retrieved
• The web server uses “echo” or “copy” directly on filename, as provided
• An attack provides a filename “stupid.txt & myMaliciousCommand”

Session Hijacking

This is sometimes also known as cookie hijacking. This is the exploitation of a valid computer session—sometimes also called a session key—to gain unauthorised access to information or services in a computer system. This type of attack happens when the Security malicious user guesses or steals the authentic token or token key for that session and by doing so, accesses the webserver system or resources as a legitimate user. This can lead to further security breaches via carrying a man-in-the-middle attack, browser attacks or even installation of malicious codes onto system.

Compliance and legislation

The challenge of legislation and compliance in the cloud is a slow adoption. Only a few internal businesses tend to be able to comply and manage to satisfy compliance in an interconnected cloud environment. Compliance requirements such as SOX, HIPPA, Safe Habour agreement are some of the main cross-country challenges businesses have to battle with to provide assurance and security. One of the biggest problems with the increased use of cloud services is that the client cannot, with confidence, control where their data is stored, who is processing or harvesting their data; and that in itself is a security challenge.

Especially where the services offered by the cloud services provider is free, the client will not have any say/control over the location their data is being stored, backed up and managed.

Compromise of Interconnected Systems

Resulting from exploitation of a trusted path through an insecure application or networkresource, resulting in the compromise of partner systems and their data; in turn leading to a loss of reputation and customer confidence. Clinton at Security Aware calls it ‘Cross contamination exploits’ – this is an exploit that has been coined in a way such that it compromises all the systems hosted in a shared environment.

Denial of Service

Resulting in the unavailability of network and application resources, potentially leading to the loss of revenue.

What are some of the vulnerabilities?

These key threats are most often realised through the following vulnerabilities within the internal network:

• Unused open ports and services
• Missing security patches/updates
• Poor design, configuration and implementation of services
• Default/generic user accounts (username & passwords)
• Lack of understanding of best practices and security requirements
• Lack of or poor internal monitoring and auditing of systems
• Excessive privileges assigned to users within an unrestricted environment

When should you perform security assessment of your cloud system?

With new vulnerabilities and malware exploits populating the web daily, it is best practice to develop a robust vulnerability management strategy to manage the threats your business faces continuously. Assessment should be done on a regular basis to have constant visibility of the threats your business faces. Some companies have systems in place to identify and manage vulnerabilities on a weekly, fortnightly or monthly basis. In some cases, bigger companies with an allocated budget and resources normally perform security assessments on a daily basis.

In addition, it is critical to perform an assessment of corporate networks and their services both prior to their initial roll out and on a regular basis to ensure that any and all specific security threats are understood, managed and remediated.