Enemies at the gate: Responses to data security threats at law firms
In eerie silence, law firms could be easily breached like JPMorgan Chase, Home Depot and Sony by cyber criminals. The difference with law firms though is that few would know the sensitive data was absconded. While law firms do not have to report such penetrations, we learned at the 5th Annual Law Firm CFO/CIO/COO Forum: Data Privacy, Security & the Globalized Law Firm, that they must increasingly stay vigilant to avoid such a plight.
The first panel discussion of the day focused on a few key data security topics and included Mike Marsilio, director of security and compliance, DTI; Mark Connelly, CISO, Thomson Reuters; Steve Katz, board member at Glasswall Solutions; John Masserini, CSO, The MIAX Exchange; and Mark Olson, vice president and CISO, Iron Mountain.
What keeps them up at night?
Masserini expressed several concerns which were mutually shared by the panel. Simply put, employees create significant anxiety. What are they downloading? What links are they clicking? Are they using dirty unencrypted jump drives on their computers? All were in agreement that internal employees’ actions can cause the most harm to a network.
Other concerns expressed included:
- Regulatory requirements
- Not having enough skilled people
- Complexity of vendors systems and vendors who are not mindful of the security concerns.
Answering some of these issues, Olson offered a few suggestions. There has to be processes in place. Enact physical requirements on your data rooms, e.g. isolating buildings and spaces. In addition, have vendors escorted into your buildings. Knowing that you have to trust some vendors, log absolutely everything. Do not allow jump drives unless cleansed by your security professionals. Ultimately the mantra of the day was educate, test, create and follow process and procedure and retrain constantly to guard against breaches.
How do you speak with the partnership about security?
The panel discussion also touched how best to convey the magnitude of security and risk with the firm partnership. One distinction they made was that the Chief Information Security Officer (CISO) must show that their investment in IT is directly related to retention and new business. If there was a breach, the harm to the brand could be irreparable. When explaining security, they suggested staying away from tech talk and painting a picture that non-technical people could understand. Partnership tends to lean-in regarding financial discussions from the CISO. When they do, IT should state it in a fashion so that “they know you know” the business is about making money. The concept driven home was that security and risk is not a cost center, rather a retention and new business play.
As the panel closed the session, they emphasized that law firms are in a precarious position. They are brokers of sensitive and important information (think IP and merger information), and to that end they are a massive target. It is the responsibility of the CISO to put in place process, procedure and pound the drum for employee education and awareness. The unseen enemy is really those employees that are uneducated, unaware, and unwilling to properly care for the firm’s tools and technology; thus exposing the firm to the outside attacks.
