Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/12/2016
09:55 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Law Firms Present Tempting Targets For Attackers

Panama Papers breach just scratched the surface of the relative lack of budget and resources in the legal sector that leaves many law firms vulnerable to cyberattacks.

The recent data breach at Panamanian law firm Mossack Fonseca that resulted in the theft of a staggering 11.5 million sensitive records highlights what analysts say is a disturbing lack of security preparedness at many law firms.

Mossack Fonseca has not disclosed how exactly it was breached. But it has blamed external actors for a theft that has exposed the potentially illicit offshore financial dealings of numerous political leaders and public figures around the world including Russian president Vladmir Putin and British prime minister David Cameron.

Many view the sheer scope of the data breach—over 2.6 terabytes of data was stolen without the firm detecting the theft—as a sign that MF did not have basic controls in place for detecting and mitigating such incidents. Unfortunately, such a lack of preparedness is fairly common in the legal industry.

Security firm BitSight, which uses a credit-score-like metric for rating the cybersecurity effectiveness of organizations, currently gives law firms a score of 690 out of 900. That puts them ahead of public relations and communications companies, but behind several other industries. Accounting firms. for example. have a rating of 740, and firms in the benefits administration space have a 750 rating from BitSight.

“The legal industry is a middle-of-the pack performer,” says Jake Olcott, vice-president at BitSight and former counsel to the House of Representatives Homeland Security Committee.

While BitSight has not done a formal study on the security posture of the legal industry, the company says it actively tracks the security performance of organizations across 22 industries using a global network of sensors. The goal is to give enterprises information to benchmark their security status against averages for their industry.

What the data shows is that little has changed on aggregate with law firms since the last time BitSight reviewed the industry’s security effectiveness a year ago. “Many of these companies are still vulnerable to high profile vulnerabilities,” he says.

For example, in a random sample of 30 large law firms with over 500 attorneys each, BitSight says it found 97% still running services that are vulnerable to the Poodle SSL flaw first reported in October 2014. About 57% had services that were vulnerable to the Freak OpenSSL issue from last year and 100% were running services that were open to the LogJam encryption flaw.

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

“Law firms,” says Olcott,” face many of the same challenges as other organizations in protecting their sensitive data.”

He points to a recent study of the legal industry’s information security assessment practices, which showed that 90% of law firms had five or fewer employees dedicated to information security. Seventy six percent had information security budgets of less than $100,000 per year.

At the same time, they present a popular target for hackers because of the sensitive information on clients that they possess. “Law firms are a key third party for many organizations,” Olcott says.

In addition to holding personally identifiable information, they often also have other highly sensitive data pertaining to things like current litigation, evidence in legal proceedings, and potentially sensitive information on company directors and officers, he says.

The value of the data stored by many law firms and the relative lack of controls for protecting it, present an opportunity for cybercriminals. According to a report by the American Bar Association last September, 25% of law firms with at least 100 attorneys are data breach victims. Yet, 47% of the law firms surveyed for the report said they had no incident response plans, while 58% of respondents in large firms said they had no chief information security officer to head the security effort.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
kwestby
50%
50%
kwestby,
User Rank: Author
4/14/2016 | 2:16:08 PM
Tip of the iceberg
I agree completly with your articles message. Having some first hand experience the vulnerability profile is much higher and risk controls even less mature than you characterize. Bitsite is only agrigating external vulnerability, bot and malware intel. The legal industry has a generally light external footprint, but a very large information sharing profile that is non-public. This is where you see the lack of focus on IT security or regulatory oversight highlighting an industry at risk for many more breaches.
cyberpink
100%
0%
cyberpink,
User Rank: Strategist
4/13/2016 | 9:32:47 AM
"Here's your sign" Moment
Thanks for giving us the here's your sign moment.  I really enjoy your articles, but this one just laid it out there for law firms. Great job.
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How Security Vendors Can Address the Cybersecurity Talent Shortage
Rob Rashotte, VP of Global Training and Technical Field Enablement at Fortinet,  5/24/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7068
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7069
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7070
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7071
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-7072
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .