Are Law Firms Taking Cyber Security Seriously? | LPI

Our guest contributor - John Duckett from inPlaceSolutions covers Cybersecurity this week and why Law firms need to take notice more than ever before.

It wasn’t that long ago that law firms might have taken a relatively relaxed approach to digital security. However, that has changed dramatically, not only because clients have higher expectations about what their service providers have in place, but because firms are also expected to demonstrate compliance to client-initiated audits. As Neil Blum, National IT Manager at Barry Nilsson says, `if a law firm doesn’t have the right security measures in place, then it risks losing clients.’

The lockdowns resulting from the current Pandemic have also reminded law firms of the need for enhanced Cyber Security, especially in respect of supporting remote workers. In a survey conducted by IPS earlier this year it was found that 72% of firms have experienced an increase in Cyber-attack activity post COVID, and that 83% of firms report an increased concern for the Senior Executive, Managing Partner and/or Board about Cyber threats. Government legislation requiring disclosure of breaches has also contributed to the implementation of improved security measures.

When determining the most critical systems in legal, email will inevitably rank as number one, and email is arguably the most common way in which lawyers still communicate with clients. The Australian legal sector has been an early adopter of solutions that provide greater email security and continuity, and the leader in this field, Mimecast, has been widely implemented. Mimecast also offers cyber awareness training modules and has recently introduced an AI module to provide more sophisticated protection for email. Cybergraph provides protection against targeted attacks by limiting the attacker’s intelligence-gathering capabilities, using machine learning and identity graph technology to detect targeted email threats, and empowering users to recognize and report threats with contextual, dynamic warning banners embedded in emails. According to Nick Lennon, Country Manager for Mimecast, `there will be some exciting roadmap items that will come out in future releases that build off the initial integration.’

Another email security product that has been gaining popularity in the legal sector is Tessian, which uses AI to continually analyse, adapt and evolve based on an understanding of normal and anomalous behaviour. This is combined with in-the-moment education to protect firms from BEC (Business Email Compromise) threats. Barry Nilsson, which also uses Mimecast, is one firm that has implemented Tessian. As Neil Blum explains, `Tessian has complimented our existing email security solutions and taken our detection and protect capabilities to new heights. Before Tessian, email data leakage detection and prevention could be a challenge. Using machine learning, Tessian automatically prevents emails or attachments being sent to the wrong recipient. This includes sensitive information sent to personal email accounts or non-business recipients, whether intentional or not.’  

To further mitigate the risk of Cyber threats many firms are now implementing SIEM (Security information and Event Management) solutions. While there are many SIEM solutions available one that features as a leader in Gartner’s Magic Quadrant and is winning clients in the Australian legal sector is Rapid7. Rapid7 is also relatively inexpensive when compared to its main competitors. But relatively inexpensive doesn’t mean cheap, and cost can still be a deterrent for some firms. However, one firm that has realised the importance of cyber security is Colin Biggers & Paisley, and as their CIO, Sam Sofianos explains, `it is easier when the investments we have made have been supported and appreciated by the business.’

But Robin Long, Rapid7’s Regional Sales Manager APA, warns that `while technology is important, many organisations continue to struggle with the people and process aspects of their security operations. Detection technologies such as SIEM are only effective provided the alerts are being investigated and the appropriate response actions taken. However, hiring, training and retaining the right security professionals to manage these solutions on a 24x7 basis is a real challenge for many organisations. As a result, Managed Detection and Response services have been gaining momentum since they can provide an effective outcome in a more efficient way.'

While it might be expensive to implement a multi-layer approach to mitigating the risk of increasingly sophisticated and increasing frequent Cyber threats the risk of an inadequate defence could ultimately prove even more expensive. Certainly, this has been the finding of several high-profile firms that have suffered breaches in recent times, a trend that should be of concern for all legal firms, and one that should ensure they continue to take the risk of Cyber Security very seriously.

John Duckett

inPlaceSolutions

www.inplacesolutions.com.au