Law.com Subscribers SAVE 30%

Call 855-808-4530 or email [email protected] to receive your discount on a new subscription.

6 Risks Affecting Cybersecurity for Law Firms

By Chris Mangano and Edward Keck, Jr.
August 01, 2022

Cybercriminals are increasingly targeting law firms; extortion is quickly realized, given the nature of highly confidential client data. The digital footprint of law firms is constantly expanding, leading to more entrances to a firm's network infrastructure, which is a direct gateway to data. This expansion, combined with insider risks (a firm's own staff), makes having risk-control protocols of paramount importance.

We are all "custodians of data." Law firms specifically are stewards of some of the most sensitive information stored and shared; a fact that doesn't elude nefarious cybercriminal syndicates. Below are some of the top cybersecurity risks affecting law firms:

  1. Distributed Denial-of-Service  (DDoS). Deliberate attempt to disrupt the traffic of a targeted edge device, network, or service by flooding the target with a surge of Internet traffic. Executed properly, a DDoS can bring down communications and result in massive disruption.
  2. Ransomware. Files/data are encrypted-locked-down, accompanied by a demand for money (generally Bitcoin) in exchange for a "key" to unlock the data. Once data is manipulated, future access remains a threat; paying the ransom is never advisable.
  3. Phishing. This tool is used to open the door to data control. Nefarious code, better known as malware, is embedded in an email. It generally asks the recipient to open a file or click on a link, launching a "payload" that propagates across the connected infrastructure, rendering much of the affected systems "locked." This leads to the "criminal ask," which is money for your data.
  4. Data Breaches. Rather than locking data, the criminal will extract sensitive files/information with the intent to sell on the Dark-Web and/or "sell back" to the law firm of origination. Control of data can lead to a variety of extortion tactics.
  5. Website Compromise. Lawyers visit and use legitimate websites as a routine part of their investigative research. Many websites are not secure; this results in the delivery of code (Malware) nested in a user's system, often remaining dormant for months. The criminal can use the malware as a "window" to activity, ultimately scrapping data and/or locking files.
  6. Environmental Cyber Threats. If law firms take little to no action in establishing best practices for data management, it makes a negligence suit more likely, in the event of a breach. Additionally, a lack of controls, policies and procedures allows disgruntled current/former staff to retaliate against the firm.

When an event, incident or breach becomes apparent, it's too late; the firm is in reactive mode, attempting to mitigate reputational harm, financial loss and widespread attention. Establishing cybersecurity compliance standards isn't just about adhering to what is "required," it is about doing what is necessary to operate in today's digital landscape.

According to the American Bar Association, virtual work environments (resulting from the pandemic) have fueled a sharp increase in breaches (25% up-tick). Federal laws governing cybersecurity are constantly evolving; this is no different for law firms. Clients span a wide range of industries; the required rules of engagement around cybersecurity best practices make a law firm's state of "readiness" a differentiator in obtaining and retaining a client.

This premium content is locked for Entertainment Law & Finance subscribers only

  • Stay current on the latest information, rulings, regulations, and trends
  • Includes practical, must-have information on copyrights, royalties, AI, and more
  • Tap into expert guidance from top entertainment lawyers and experts

For enterprise-wide or corporate acess, please contact Customer Service at [email protected] or 877-256-2473

Read These Next
Major Differences In UK, U.S. Copyright Laws Image

This article highlights how copyright law in the United Kingdom differs from U.S. copyright law, and points out differences that may be crucial to entertainment and media businesses familiar with U.S law that are interested in operating in the United Kingdom or under UK law. The article also briefly addresses contrasts in UK and U.S. trademark law.

Strategy vs. Tactics: Two Sides of a Difficult Coin Image

With each successive large-scale cyber attack, it is slowly becoming clear that ransomware attacks are targeting the critical infrastructure of the most powerful country on the planet. Understanding the strategy, and tactics of our opponents, as well as the strategy and the tactics we implement as a response are vital to victory.

The Article 8 Opt In Image

The Article 8 opt-in election adds an additional layer of complexity to the already labyrinthine rules governing perfection of security interests under the UCC. A lender that is unaware of the nuances created by the opt in (may find its security interest vulnerable to being primed by another party that has taken steps to perfect in a superior manner under the circumstances.

Removing Restrictive Covenants In New York Image

In Rockwell v. Despart, the New York Supreme Court, Third Department, recently revisited a recurring question: When may a landowner seek judicial removal of a covenant restricting use of her land?

Fresh Filings Image

Notable recent court filings in entertainment law.