Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Protect assets from ransomware, trojans, rootkits and more.
Intelligence and visibility across AWS, O365, DevOps and more.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Sheriff Brody said it best when he came face-to-face with the great white shark that was menacing the town of Amity Island in Spielberg’s 1975 blockbuster, Jaws. And the same sentiment holds true for smaller law firms hunting large clients. The risk and responsibilities that come with large clients, such as pharmaceutical companies, disruptor banks, and investment firms, remain the same, regardless of the size of your law firm.
Unlike large firms with comparable resources with which to protect client non-public information, small firms can find themselves trapped between cyberattacks, like ransomware, that don’t prejudice based on the size of firm, and regulators who are indifferent to your size, when investigating a potential violation.
The attack on Wall Street law firms Cravath, Swaine & Moore LLP and Weil, Gotshal & Manges LLP demonstrated how stolen information, such as FDA filings and press releases, could be used to front run trades. In this case, a law firm managed HIPAA protected healthcare data and the stolen information was used to violate SEC rules and federal market laws.
These regulated clients create a significant reporting burden. Consider for example that under HIPAA compliance standards for healthcare operators and New York financial institutions governed by the Department of Financial Services (DFS), you would be required to report a material cyber breach with 72 hours. Moreover, under DFS you would have to contribute to an annual declaration on the part of the client in which not only material breaches are inventoried, but unsuccessful attempts are also documented. This can be a significant task for banks with large security teams, let alone a small law firm outsourcing IT operations.
As an industry, law firms have improved their overall cybersecurity hygiene and practices, which has resulted in a lower-than-average amount of nuisance cyberattacks as compared to other industries like healthcare, manufacturing and energy. That said, criminals consider law firms a lucrative target, and as a result, our research shows the legal industry suffers 30% more malicious attacks than other businesses. This is a symptom of cyber threats evolving from opportunistic means and transactional payments, to targeted and negotiated extortion.
These trends do not delineate by firm size. A 90-day snapshot of eSentire’s security operations statistics comparing large firms to small indicates a proportional volume of security incidents, but not so when examining breaches and security events that require immediate response. For example, consider that a large firm may represent 500-750 attorneys across 20 locations, while a small firm may have 25-50 attorneys at one location. Now consider that the small firm generates about 65,000 security traffic elements that filter down to 20 incidents, leading to one urgent incident requiring immediate response. On the other hand, the large firm generates over 40 times more traffic, 325 security incidents (16 times more), but only one escalation.
While the larger firm generates significantly more security traffic elements, the large firm/small firm ratio of escalated incidents requiring emergency response moves closer to one-to-one as the security events are investigated. Diving deeper, the data indicates that the emergency incidents were born of the same, industry-targeted attack. In other words, both the large and small firm were impacted and breached by the same targeted attack. Neither the criminals, nor their tools discriminate by the number of attorneys.
It’s not unreasonable to think that the common cyber practices and investment levels of a large law firm are not the same as those that a small firm can manage. There is no one-size-fits-all when it comes to establishing standards of reasonable care. The ABA Cybersecurity Handbook: A Resource for Attorneys, Law Firms and Business Professionals (ABA 2017), contains a resource-right-sized approach with a checklist that smaller firms can use to build a simplified cybersecurity program:
As you look to expand business or retain your key clients in a growing environment of cyber threats, remember Sheriff Brody’s advice: Size does matter when you’re going after big fish. Weigh the benefits and risks, and recognize that there is chum in the water, put there by criminals and regulators alike. And be prepared for the behemoth that might bite your line.
This article originally appeared on Law Journal Newsletters.
Mark is a cybersecurity evangelist who has spent significant time researching and speaking to peripheral factors influencing the way that legal firms integrate cybersecurity into their day-to-day operations.