Law.com Subscribers SAVE 30%

Call 855-808-4530 or email [email protected] to receive your discount on a new subscription.

Security First Approach Provides a Significant Advantage to Law Firms

By Mark Sangster
December 01, 2017

Monumental cyber events, such as the recent Equifax breach, draw enormous press attention, public outrage and government scrutiny. The coverage is almost exclusively negative, challenging the security capabilities of the firm and questioning whether negligence played a role. These breach stories fuel a security industry that all too often feeds on fear, uncertainty and doubt — a practice collectively referred to as selling FUD. The security industry all too often sells the next shiny object touted as the Holy Grail of security that protects against all cyber threats. And the following year, the next best thing hits the market and becomes the grail until proven fallible. When the industry gets wise to this cycle of promise and disappointment, security vendors switch to the other side of their mouths to espouse a security strategy of multiple systems and technologies, known as defense in depth.

For the most part, this practice prevails, and perhaps even suits, an economy built on free-market companies that overlook cybersecurity until they suffer a cyber near miss, a devastating cybersecurity event, or when the government and regulators turn their investigatory sights on their industry and operations (jovially referred to as the Eye of Sauron, in reference to the Lord of the Rings). Only then do most companies adopt a more hardened security practice. However, there is a movement towards a security first approach within more proactive organizations.

Security First Is a Competitive Advantage

Security first is a holistic approach that views security not as an information technology nuisance in need of tight cost-management controls, but as a competitive advantage to differentiation from traditional business offerings. With this shift, service providers can tailor their offering to clients in heavily regulated industries, or those that control highly confidential information such as financial information, healthcare records, or other forms of sensitive personally identifiable information (PII).

Most regulatory frameworks, including those of the Securities Exchange Commission (SEC) and Health Insurance Portability and Accountability Act (HIPAA), include provisions for vendors, business associates, consultants, and other third-parties with access to controlled data. The security-first approach provides a significant advantage to firms with existing regulated clients, or building a new practice as a third-party within regulated industries.

Security first plays a dual role for law firms. First, any law firm engaging with SEC-regulated financial institutions, such as hedge funds or healthcare providers (HIPAA governed), will no doubt have to build out a robust and documented cybersecurity program in order to pass the scrutiny of their clients. Completing due diligence questionnaires (DDQ) for banks and hospitals is now all too common and incredibly time-intensive for those teams involved.

Within financial services, alternative investment funds (generally referred to as hedge funds) adopted a security first approach in response to the proliferation of due diligence requests from banks and potential investors.

What Is AITEC?

AITEC was founded by investment technology leaders as a private secure community of senior management experts who share advice, knowledge, insights, and best practices with each other for the betterment of the alternative investment industry.

In response to the pressures presented by answering constant and varying DDQs, they partnered with AIMA (Alternative Investment Management Association) to create a standardized security DDQ that worked as a framework for investment firms upon which to build their cybersecurity policies and procedures. It gave investors and clients a way of accurately measuring those firms and their cybersecurity policies and procedures. There are now over 100 vendors using the DDQ within the industry.

A security-first approach starts with the legal industry building its own standard, leveraging guidance from the American Bar Association (ABA), the International Legal Technology Association (ILTA) LegalSEC council, and the Association of Legal Administrator (ALA). The approaches described leverage security first as a means of retaining existing business or perhaps entering new opportunities within highly regulated, or at least controlled, industries.

More progressive law firms have moved beyond this effort to build out their own privacy and data security practices founded on their enriched security posture.

Law firms are uniquely positioned to provide privacy and data security guidance and expertise. As I have been known to say, “all roads lead to Rome,” which in this case refers to law firms. Firms help write legislation at all levels of government, and then interpret these laws on behalf of their clients. Law firms broker business insurance, establish governance and legal policies at the business level, broker financial deals, lead mergers and acquisitions, file patents and copyrights, and so on. Law firms are the nexus of the economy.

As such, law firms are actively engaged in numerous facets of cybersecurity from planning, prevention, response and post-event litigation:

Planning

  • Risk management consulting: Helping businesses audit sensitive assets under management, determining top cyber risks, and building out a risk management plan including data protection, breach notification, insurance, etc.
  • Board-level cybersecurity awa­reness and obligation training: Board members have an incumbent duty to include cyber security in their fiduciary responsibilities, yet many board members lack an understanding of cyber risks and how they affect their duty as a board member. Law firms can interpret responsibilities and create a framework of responsibilities, reporting, budgeting, and risk management.
  • Cyber insurance policy and planning: Cyber insurance is becoming a standard part of any company's risk management policy, yet in absence of actuarial data, and with myriad options, companies need advice on how to build a portfolio of insurance that aligns to their needs and budget.

Prevention

  • Global data transfer solutions: The transfer of data across national and international borders creates a convoluted patch work of privacy and breach notifications laws — think GDPR. Laws firm can help navigate this regulatory maze.
  • Compliance with local privacy laws: Helping determine local compliance with state, national, and international data protection, privacy (such as right to be forgotten), and other legislative obligations.

Response

  • Incident response and post-breach crisis management: Law firms have a role to play in incident response planning and post-breach response including the technical investigation, coordination with law enforcement, and exercising notification requirements. In The event of a breach, the lawyer of record or general counsel should be the first call, and as such become the quarter back in any response program.
  • Government and law officials' data requests: When government or law officials request data, this places companies in a difficult position between protecting their customer's privacy expectations, while cooperating with law enforcement as required by statue. Law firms must quarterback such requests and the resulting exchanges of data.

Litigation and Defense

  • Regulatory examinations and defense: Firms require legal advice in matters of regulatory examinations, understanding requirements, compliance standards, transfers of data or evidence, and potential legal defenses if the regulatory investor levies fines or files criminal charges.
  • Class-action suits resulting from a data breach: In the wake of Target and other retailers, and now Equifax, class-action suits, or suits between vendors and customers, are standard fare post-breach. Law firms play a traditional role here providing either plaintiff or defense services.
  • Intellectual property protection: In certain cases, data breaches result in the loss of intellectual property rather than money or other data which is resold on the dark markets. When IP is stolen, it often emerges in the hands of competitors and original owners will seek damages or rendition of IP violations.

Conclusion

Law firms have a unique opportunity to promote the adoption of an enriched security program across the economy, while building a business based on a security first philosophy. It's a win-win situation. However, the window for a distinct advantage leveraging security will only remain open for a finite period. Once a few prospectors strike gold, every hopeful will descend on the same claimed opportunity with a shovel and pick. Those that stake a claim early will have a significant advantage as a security first provider, and will remain both technically and economically ahead of those parties that begrudgingly adopt an updated security posture because everyone else is.

*****
Mark Sangster is a cybersecurity evangelist who has spent significant time researching and speaking to peripheral factors influencing the way that legal firms integrate cybersecurity into their day-to-day operations. In addition to his role as VP and industry security strategist with managed cybersecurity services provider eSentire, he also serves as a member of the LegalSec Council with the International Legal Technology Association (ILTA). He can be reached at [email protected].

This premium content is locked for Entertainment Law & Finance subscribers only

  • Stay current on the latest information, rulings, regulations, and trends
  • Includes practical, must-have information on copyrights, royalties, AI, and more
  • Tap into expert guidance from top entertainment lawyers and experts

For enterprise-wide or corporate acess, please contact Customer Service at [email protected] or 877-256-2473

Read These Next
COVID-19 and Lease Negotiations: Early Termination Provisions Image

During the COVID-19 pandemic, some tenants were able to negotiate termination agreements with their landlords. But even though a landlord may agree to terminate a lease to regain control of a defaulting tenant's space without costly and lengthy litigation, typically a defaulting tenant that otherwise has no contractual right to terminate its lease will be in a much weaker bargaining position with respect to the conditions for termination.

How Secure Is the AI System Your Law Firm Is Using? Image

What Law Firms Need to Know Before Trusting AI Systems with Confidential Information In a profession where confidentiality is paramount, failing to address AI security concerns could have disastrous consequences. It is vital that law firms and those in related industries ask the right questions about AI security to protect their clients and their reputation.

Generative AI and the 2024 Elections: Risks, Realities, and Lessons for Businesses Image

GenAI's ability to produce highly sophisticated and convincing content at a fraction of the previous cost has raised fears that it could amplify misinformation. The dissemination of fake audio, images and text could reshape how voters perceive candidates and parties. Businesses, too, face challenges in managing their reputations and navigating this new terrain of manipulated content.

Authentic Communications Today Increase Success for Value-Driven Clients Image

As the relationship between in-house and outside counsel continues to evolve, lawyers must continue to foster a client-first mindset, offer business-focused solutions, and embrace technology that helps deliver work faster and more efficiently.

Pleading Importation: ITC Decisions Highlight Need for Adequate Evidentiary Support Image

The International Trade Commission is empowered to block the importation into the United States of products that infringe U.S. intellectual property rights, In the past, the ITC generally instituted investigations without questioning the importation allegations in the complaint, however in several recent cases, the ITC declined to institute an investigation as to certain proposed respondents due to inadequate pleading of importation.