A quick Google search for ‘law firm hacked’ reveals more than 5 million search results of articles and news stories on law firms becoming victims of cybercriminals in the past few years.

Unlike most chambers, many of these law firms will have cybersecurity departments, well-equipped IT departments, large budgets, the fanciest defence software and yet somehow still managed to lose control over their data.

When a breach happens, hackers often stay in the compromised network for months – sometimes years. The ‘average’ detection time is beyond 6 months, but you and I know that ‘average’ could mean 1 day, or 10 years. This causes direct and indirect damage to your clients and employees, your reputation and finances, not to mention the possibility of extortion and the ‘unknown unknowns’.

Can you definitely say – and this question is particularly pertinent when members of chambers and staff are working remotely – that no unauthorized code ran on their computers last week? Did anyone access a compromised website, thus exposing you all to malicious code? Did any malicious code bypass your antivirus program and if it did, what did it do after that? Did it send any confidential documents over an encrypted channel to a server in China? If so, how many documents were lost? Did the hacker then move on to other computers in the same network?

I am a firm believer that sound security architecture will trump any commercial security software and product. If you have well designed and tuned IT infrastructure, you will be head and shoulders above the mass of chambers who only depend on basic security controls provided by their IT support firm. Achieving that, you will have a competitive advantage – and every little bit helps!

The first and likely most important task when designing a chambers’ defences is to step back and look at all the major software elements in it.

Are you using a document management system and a filing system? Are they tightly integrated into your email and collaboration systems?

A weakness or a vulnerability in any IT system could lead to a security breach in all of them.

A chain is only as strong as its weakest link!

And a chambers is only as resistant to a hacking attack as its least protected IT system.

Unfortunately, antivirus and firewalls are weak and unreliable against hackers – they are straightforward to bypass and present no challenge.

What helps:

  1. Updating your software: Windows and Mac computers are equally vulnerable when not patched on time.
  2. Updating your Office suites: hackers are increasingly targeting unconfigured Office programs such as Outlook, Word, and Excel with malicious documents. Once a barrister, pupil or member of staff opens such a document, their computer gets infected and is immediately remotely accessible to the hackers. In turn, a hacked computer makes all your document management, filing, and practice management systems with all client data in them accessible to the hackers immediately.
  3. People see their browsing habits as just that, browsing. Hackers see your browser as an entry point and a door to all your client files. Configure your browser securely to prevent exploitation when visiting hacked websites. In some of my breach investigation work, I have seen parents visiting their kid’s school just to get hacked because the school’s website was hacked and served malware.

Vulnerability management has to become a part of your IT management strategy. If you can’t answer the question ‘how many vulnerabilities did you have last month and are they fewer this month,’ then how can you even be sure that you haven’t already been hacked?

Vulnerability management as a process should be a part of a more sophisticated approach. Hackers have had decades to hone their skills and breach methods. If all you are using to protect chambers against trained hackers is a firewall and an antivirus, it is time to upgrade.

Some examples of processes that need to be in place for your chambers to be secure:

  • Password, identity and access management: who has access to what, why, for how long and where is their password stored? Is the password secure against guessing attacks?
  • Attack mitigation: there are 17 major types of cyberattacks, and any of them can be used against your chambers. Have you got a plan to mitigate them? What about any new attack that comes up every few months?
  • Cybersecurity awareness – does anyone provide all barristers and members of staff with an awareness campaign of the types of attacks that hackers will use against them?

As the founder of Atlant Security, I can help you establish a solid foundation of defending client data and funds against cyberattacks. If you want to get started on a journey to turn your chambers into a fortress, get in touch!

Published on 27 November 2020.