Law Firms Present Tempting Targets For Attackers

The recent data breach at Panamanian law firm Mossack Fonseca that resulted in the theft of a staggering 11.5 million sensitive records highlights what analysts say is a disturbing lack of security preparedness at many law firms.

Mossack Fonseca has not disclosed how exactly it was breached. But it has blamed external actors for a theft that has exposed the potentially illicit offshore financial dealings of numerous political leaders and public figures around the world including Russian president Vladmir Putin and British prime minister David Cameron.

Many view the sheer scope of the data breach—over 2.6 terabytes of data was stolen without the firm detecting the theft—as a sign that MF did not have basic controls in place for detecting and mitigating such incidents. Unfortunately, such a lack of preparedness is fairly common in the legal industry.

Security firm BitSight, which uses a credit-score-like metric for rating the cybersecurity effectiveness of organizations, currently gives law firms a score of 690 out of 900. That puts them ahead of public relations and communications companies, but behind several other industries. Accounting firms. for example. have a rating of 740, and firms in the benefits administration space have a 750 rating from BitSight.

“The legal industry is a middle-of-the pack performer,” says Jake Olcott, vice-president at BitSight and former counsel to the House of Representatives Homeland Security Committee.

While BitSight has not done a formal study on the security posture of the legal industry, the company says it actively tracks the security performance of organizations across 22 industries using a global network of sensors. The goal is to give enterprises information to benchmark their security status against averages for their industry.

What the data shows is that little has changed on aggregate with law firms since the last time BitSight reviewed the industry’s security effectiveness a year ago. “Many of these companies are still vulnerable to high profile vulnerabilities,” he says.

For example, in a random sample of 30 large law firms with over 500 attorneys each, BitSight says it found 97% still running services that are vulnerable to the Poodle SSL flaw first reported in October 2014. About 57% had services that were vulnerable to the Freak OpenSSL issue from last year and 100% were running services that were open to the LogJam encryption flaw.

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

“Law firms,” says Olcott,” face many of the same challenges as other organizations in protecting their sensitive data.”

He points to a recent study of the legal industry’s information security assessment practices, which showed that 90% of law firms had five or fewer employees dedicated to information security. Seventy six percent had information security budgets of less than $100,000 per year.

At the same time, they present a popular target for hackers because of the sensitive information on clients that they possess. “Law firms are a key third party for many organizations,” Olcott says.

In addition to holding personally identifiable information, they often also have other highly sensitive data pertaining to things like current litigation, evidence in legal proceedings, and potentially sensitive information on company directors and officers, he says.

The value of the data stored by many law firms and the relative lack of controls for protecting it, present an opportunity for cybercriminals. According to a report by the American Bar Association last September, 25% of law firms with at least 100 attorneys are data breach victims. Yet, 47% of the law firms surveyed for the report said they had no incident response plans, while 58% of respondents in large firms said they had no chief information security officer to head the security effort.

Related stories: