Law firm data retention – they can’t hack what you no longer have
Latest from Information Bytes
Law firms, data security policies, and cobblers’ kids
You’d think, among all types of businesses, that law firms would be at the front of the pack in having a data security policy. After all, law firms regularly tell their clients how important it is to have effective policies in place for legal compliance and risk management. And law firms certainly possess large volumes of valuable data, such as confidential client information and individual’s personal data, and are subject to a daunting array of…
How to gain assurance against human security vulnerabilities
If you had a choice between doctors to perform surgery on you, which would you pick: a doctor who has sat through training on how to perform an appendectomy; or assurance that your doctor will successfully perform your appendectomy?
The answer seems obvious, but on the topic of dealing effectively with human vulnerabilities in cybersecurity, most of us seem satisfied with “awareness training.” It’s a check-the-box response to regulatory compliance or client demands. Sign everyone up for…
The latest Mueller indictment – what we all can learn about sources and methods
The indictment filed last Friday by Special Counsel Robert Mueller explains how Russian military intelligence officers hacked into computer systems of the DNC, the DCCC, and Clinton Campaign employees during the 2016 presidential race. With sweeping, specific details that have compelled unanimous confidence among Americans (except apparently our President), the 29-page indictment is a textbook on sources and methods. No, not intelligence-gathering sources and methods, which are of course highly classified. Instead, the indictment…
(But wait, I didn’t) notice and consent
I keep getting asked about Cambridge Analytica and Facebook. And no one seems to like my response – I’m frankly amazed that this all took so long to blow up. How long? How about since 1973. That’s when the U.S. Department of Health, Education, and Welfare first articulated the Fair Information Practice Principles (FIPPs or FIPs) in its report Records, Computers, and the Rights of Citizens: Report of the Secretary’s Advisory Committee on Automated Personal Data Systems…
So, I asked a hacker about technical vulnerabilities …
Testing for technical vulnerabilities is a key part of security risk assessment. To get the straight scoop on technical vulnerabilities, and how they’re exploited, why not ask a hacker?
Dave Chronister is an ethical hacker, a Certified Information Systems Security Professional, and the co-founder and managing partner of Parameter Security. To borrow from the Farmer’s Insurance commercials, Dave knows a thing or two because he’s seen a thing or two. He started early –…
Security risk assessment is not just a good idea – it’s a compliance requirement
Would you take a deposition by solely following a template of standard questions, without assessing the unique issues and circumstances of the case? Or conduct transaction due diligence by simply marching though a generic punch list, without assessing the unique aspects of the company, the deal, and the industry? Of course not. Your law firm’s data security posture is no different – you need a security risk assessment to understand your firm’s unique vulnerabilities to…
Security Risk Assessment: You can’t fix what you can’t see.
I had a nagging worry that something was wrong with my car, so I finally decided to take it to the dealer. I couldn’t exactly describe my concern, except there was an intermittent, “funny noise” coming from somewhere in the front end. An unscrupulous dealer would have taken me down a long path of parts replacement, beginning with tires, then wheels, then tie rods, and on and on, perhaps never fixing the real problem. Fortunately,…
Understanding law firms’ unique security vulnerabilities – the key to turning bad news into good news
As explored in last week’s posts, the bad news for law firms is their challenging data security threat environment. On the other hand, law firms that meaningfully elevate their security posture, thereby outrunning less-secure firms, can enjoy good news, including increased revenue, better-controlled expenses, and stronger client relationships.
Security risks flow from threats coupled with vulnerabilities – and when it comes to data security, law firms are uniquely vulnerable. Understanding and countering these vulnerabilities…
Good news on law firm data security
Law firms face significant data security threats. But there’s good news for law firms on data security. When firms are serious about their data safeguards and take concrete steps to strengthen their security profile, they better position themselves for higher revenue, lower and better-controlled expenses, and stronger client relationships.
As always, context matters. The legal services industry has changed dramatically in the last decade, with private practice law firms facing (a) increased competition from…