Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/12/2016
09:55 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Law Firms Present Tempting Targets For Attackers

Panama Papers breach just scratched the surface of the relative lack of budget and resources in the legal sector that leaves many law firms vulnerable to cyberattacks.

The recent data breach at Panamanian law firm Mossack Fonseca that resulted in the theft of a staggering 11.5 million sensitive records highlights what analysts say is a disturbing lack of security preparedness at many law firms.

Mossack Fonseca has not disclosed how exactly it was breached. But it has blamed external actors for a theft that has exposed the potentially illicit offshore financial dealings of numerous political leaders and public figures around the world including Russian president Vladmir Putin and British prime minister David Cameron.

Many view the sheer scope of the data breach—over 2.6 terabytes of data was stolen without the firm detecting the theft—as a sign that MF did not have basic controls in place for detecting and mitigating such incidents. Unfortunately, such a lack of preparedness is fairly common in the legal industry.

Security firm BitSight, which uses a credit-score-like metric for rating the cybersecurity effectiveness of organizations, currently gives law firms a score of 690 out of 900. That puts them ahead of public relations and communications companies, but behind several other industries. Accounting firms. for example. have a rating of 740, and firms in the benefits administration space have a 750 rating from BitSight.

“The legal industry is a middle-of-the pack performer,” says Jake Olcott, vice-president at BitSight and former counsel to the House of Representatives Homeland Security Committee.

While BitSight has not done a formal study on the security posture of the legal industry, the company says it actively tracks the security performance of organizations across 22 industries using a global network of sensors. The goal is to give enterprises information to benchmark their security status against averages for their industry.

What the data shows is that little has changed on aggregate with law firms since the last time BitSight reviewed the industry’s security effectiveness a year ago. “Many of these companies are still vulnerable to high profile vulnerabilities,” he says.

For example, in a random sample of 30 large law firms with over 500 attorneys each, BitSight says it found 97% still running services that are vulnerable to the Poodle SSL flaw first reported in October 2014. About 57% had services that were vulnerable to the Freak OpenSSL issue from last year and 100% were running services that were open to the LogJam encryption flaw.

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

“Law firms,” says Olcott,” face many of the same challenges as other organizations in protecting their sensitive data.”

He points to a recent study of the legal industry’s information security assessment practices, which showed that 90% of law firms had five or fewer employees dedicated to information security. Seventy six percent had information security budgets of less than $100,000 per year.

At the same time, they present a popular target for hackers because of the sensitive information on clients that they possess. “Law firms are a key third party for many organizations,” Olcott says.

In addition to holding personally identifiable information, they often also have other highly sensitive data pertaining to things like current litigation, evidence in legal proceedings, and potentially sensitive information on company directors and officers, he says.

The value of the data stored by many law firms and the relative lack of controls for protecting it, present an opportunity for cybercriminals. According to a report by the American Bar Association last September, 25% of law firms with at least 100 attorneys are data breach victims. Yet, 47% of the law firms surveyed for the report said they had no incident response plans, while 58% of respondents in large firms said they had no chief information security officer to head the security effort.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
kwestby
50%
50%
kwestby,
User Rank: Author
4/14/2016 | 2:16:08 PM
Tip of the iceberg
I agree completly with your articles message. Having some first hand experience the vulnerability profile is much higher and risk controls even less mature than you characterize. Bitsite is only agrigating external vulnerability, bot and malware intel. The legal industry has a generally light external footprint, but a very large information sharing profile that is non-public. This is where you see the lack of focus on IT security or regulatory oversight highlighting an industry at risk for many more breaches.
cyberpink
100%
0%
cyberpink,
User Rank: Strategist
4/13/2016 | 9:32:47 AM
"Here's your sign" Moment
Thanks for giving us the here's your sign moment.  I really enjoy your articles, but this one just laid it out there for law firms. Great job.
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-16632
PUBLISHED: 2021-05-15
A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.
CVE-2021-32073
PUBLISHED: 2021-05-15
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
CVE-2021-33033
PUBLISHED: 2021-05-14
The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
CVE-2021-33034
PUBLISHED: 2021-05-14
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
CVE-2019-25044
PUBLISHED: 2021-05-14
The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.