Securing Each Link in the e-Discovery Chain

FedRAMP standards only cover the cloud, which is only one component in the e-discovery process. Firms need to pull back the lens and take a broader look at security and encryption throughout the entire workflow — from data collection at the very beginning of the e-discovery process through to disposition of data at the end.

FedRAMP Explained

FedRAMP was developed in collaboration with the National Institute of Standards and Technology, federal agencies and chief information officers in government and the private sector. Introduced in 2012, the standard stipulates that cloud vendors require multiple levels of security. (See sidebar, “Security Provisions of FedRAMP.”)

Regarding encryption specifically, the standard instructs vendors to encrypt:

• Data partitions and swap partitions
• File systems, including temporary ones, and files themselves
• Storage devices
• Log files
• Databases
• Virtual machine images that are not running

The standard ensures that federal data in the cloud is secure. However, the history of data breaches and security flaws has shown that cloud security is not necessarily the source of most breaches.

An incident last summer illustrates the weakest link in any security chain — the human being. An attorney at Wells Fargo accidently shared private information of more than 50,000 Wells Fargo clients with an outside lawyer. Wells Fargo said the information “was inadvertently released to a lawyer as the result of a subpoena.” Details on how the information was shared were scarce, but it appears it was not encrypted.

Encryption is still not widely used in the legal industry, including at law firms. A study of encryption trends by the Ponemon Institute found that, overall, the percentage of IT budget devoted to encryption has decreased over the last three years. In the industry category of “services,” which includes legal services, the use of encryption is on the rise, but still remains just half, 50%. (The “public sector” category is even lower, at 39%.)

To ensure a high level of security, general counsels and law firms must ask critical questions and encrypt data at each step in the e-discovery process.

Data collection (both physically and electronically). At the start of the e-discovery process, how are the parties sharing information? If data is being shared on a physical medium, make sure the hard drive or thumb drive is encrypted. If sent electronically, encrypt the data in transit.

Data processing (deduplication and filtering). This is usually done in a law firm's internal system. Is that network secure? What controls are there in terms of access? Are the attorneys able to dial in remotely to access the data and perform keyword searches to cull it down? Are they using a VPN or other secure tunnel?

Data transmission to the cloud service provider for review and document coding. Make sure the data is encrypted in transit or, if using “sneaker-net,” that the drive is encrypted. Remember that Eric Snowden walked out of NSA office in Oahu with a thumb drive.

Document review: Similar to above, how secure is remote or web based access? How do attorneys access the information? Are you making sure that the information stays in the cloud protected by the mandated security and is not downloaded to someone's computer? In 2015 an NSA contractor put classified material about how the U.S. defends against cyberattacks on his home computer, which was then hacked, allegedly by hackers for the Russian government.

Document production: What controls are in place when attorneys export the relevant documents? Is the data encrypted in transit?

Post-discovery: After a matter ends, who is responsible for securely disposing of the data? Whether it's a service provider, law firm or another entity, the most secure technique is the Department of Defense wiping standard 5220.22-M, which overwrites the data three times with computer-generated random characters so it cannot be recovered by any commercially available process.

Conclusion

Today, the cloud has earned the confidence of federal government agencies, including those that store top-secret information. A top technologist at the CIA recently remarked that the cloud is better equipped than legacy systems to house the country's most sensitive data. “The cloud on its weakest day is more secure than a client service solution,” said Sean Roche, associate deputy director at the CIA's Digital Innovation Directorate. “Encryption runs seamlessly on multiple levels. It's been nothing short of transformational.”

By reviewing the various phases in the e-discovery workflow for security and encryption, you'll ensure that the data is protected before and after the cloud as well. Sidebar: Security Provisions of FedRAMP

Under FedRAMP, cloud service providers are required to:

• Clearly define and describe system boundaries
• Identify customer responsibilities and what they must do to implement controls
• Provide identification and two- and sometimes multi-factor authentication for network access to privileged accounts, non-privileged accounts
• Provide identification and two- and sometimes multi-factor authentication for local access to privileged accounts
• Perform code analysis scans for code written in-house (non-commercial off-the-shelf products)
• Set boundary protections with logical and physical isolation of assets
• Be able to remediate high-risk issues within 30 days, medium-risk within 90 days
• Provide an inventory and configuration-build standards for all devices
• Provide safeguards to prevent unauthorized information transfer via shared resources
• Provide cryptographic safeguards to preserve confidentiality and integrity of data during transmission

Source: “A Guide To Understanding FedRAMP,” by U.S. General Services Administration.

*****

David A. Greetham is vice president of e-Discovery, Ricoh Americas Corporation.