{"id":36915,"date":"2016-04-28T19:35:16","date_gmt":"2016-04-28T19:35:16","guid":{"rendered":"https:\/\/www.consilio.com\/resource\/eye-on-discovery-11-5-million-reasons-for-law-firms-to-take-data-security-seriously\/"},"modified":"2021-04-14T03:30:21","modified_gmt":"2021-04-14T07:30:21","slug":"eye-on-discovery-11-5-million-reasons-for-law-firms-to-take-data-security-seriously","status":"publish","type":"avada_portfolio","link":"https:\/\/uk.consilio.com\/resource\/eye-on-discovery-11-5-million-reasons-for-law-firms-to-take-data-security-seriously\/","title":{"rendered":"Eye on Discovery – 11.5 Million Reasons for Law Firms to Take Data Security Seriously"},"content":{"rendered":"

Eye on Discovery – 11.5 Million Reasons for Law Firms to Take Data Security Seriously<\/strong><\/h1><\/span>
<\/div><\/div><\/div>

In early April, we bore witness to what may be the largest data breach in history: 11.5 million confidential documents spanning 40 years were leaked from Panamanian law firm Mossack Fonseca to German newspaper S\u00fcddeutsche Zeitung<\/em>. So far, the aftermath of the Panama Papers<\/a> has included speculation about potential money laundering, fraud and corruption by numerous world leaders, sports figures and billionaires. The Prime Minister of Iceland has already resigned, with more fallout still to come as the U.S. Attorney for the Southern District of New York recently launched a criminal investigation into matters disclosed in the breach.<\/p>\n

The law firm claims the leak resulted from an unauthorized breach of its email server, though some have speculated that an internal source was to blame. Regardless of the cause, the scandal has highlighted the need for law firms to closely examine their cybersecurity practices. Going forward, regulators as well as clients are likely to demand security audits and law firms should focus on shoring up their cybersecurity to comply with data protection laws as well as their ethical duty to protect their clients\u2019 data.<\/p>\n

Here are 11.5 strategies law firms can immediately employ to begin improving their data security.<\/p>\n

1. Form a data security team.<\/strong><\/p>\n

Law firms cannot afford to designate security to IT and forget about it. To ensure every aspect of the firm is considered, law firms should establish a data security team consisting of IT, practice leaders, security personnel, human resources, procurement, finance, and other key departments. Law firms should consider hiring one or more information security professionals who can guide investments and initiatives with the requisite skill and experience. Breach Response Plans and periodic breach exercises ensure the team is ready to handle a breach scenario.<\/p>\n

2. Create robust data security policies.<\/strong><\/p>\n

The firm should establish written information security policies regarding the use of data, including data stored on mobile devices and portable devices such as laptops and thumb drives. Remote access policies should address the risks of public Wi-Fi areas. Data Classification Standards should instruct employees about the sensitivity of information and where it may be stored or shared, either internally or through external cloud services.<\/p>\n

3. Require the use of complex passwords.<\/strong><\/p>\n

Law firms must require employees to use complex passwords with a combination of letters, numbers, and symbols. Firms must also prompt employees to change their passwords frequently\u2014at least twice a year. Employees should also turn on password settings on all of their mobile devices, or better yet, enforce device passwords with Mobile Device Management software.<\/p>\n

4. Promote cybersecurity awareness.<\/strong><\/p>\n

It takes more than policies to weave security into the firm culture, and risky user behavior is often a significant weakness in law firm security. Firms should require training on current best practices and policy requirements and send periodic updates to remind employees regarding their role in protecting client data. In a law firm environment, this should include all personnel who may come into contact with client information, from partners and paralegals to temps and cleaning staff.<\/p>\n

5. Keep technology up-to-date.<\/strong><\/p>\n

Firms should implement security patches and updates as soon as they are available. Mossack Fonseca had not updated its Outlook Web Access login since 2009 or its client login portal since 2013. The firm\u2019s website relied on an outdated version of WordPress, while its client portal opened itself to hackers by using an outdated open-source content management system with at least 25 known vulnerabilities. The same holds true with protective technologies, such as antivirus, spyware, and firewall solutions \u2013 they should all be kept up to date with the latest versions.<\/p>\n

6. Encrypt emails and mobile devices.<\/strong><\/p>\n

Mossack Fonseca did not encrypt its email. But given the sensitivity of privileged materials, work product, trade secrets, and other proprietary and confidential email traveling through cyberspace, it makes sense to accord email with the highest level of security. As email encryption over the internet requires that each client supports encryption on their end as well, consider additional software for secure end-to-end messaging for highly secure files and information. Law firms should also encrypt client data while at rest as well as while it is in motion across a network. All laptops, smartphones and other mobile devices should be encrypted.<\/p>\n

7. Govern data with an iron fist.<\/strong><\/p>\n

Law firms should create a data map that inventories their data sources, hardware and software systems and categorizes them according to their risk. They should then deploy escalating security measures commensurate with the risk. Client data should be retained only as long as it has a legal or business purpose; thereafter, it should be destroyed as part of an information governance program.<\/p>\n

8. Compartmentalize sensitive information.<\/strong><\/p>\n

Access to client information should be restricted based on \u201cneed to know\u201d. Only those personnel working on a client or matter should have access to the information. Further, some highly sensitive information should be restricted to an ever smaller subset. Databases which contain sensitive information should also be segmented across multiple systems, so that hacking into only one of them doesn\u2019t provide useful information. Law firms should also consider storing information in some regions and countries locally rather than centrally based on risk profiles and data sovereignty laws.<\/p>\n

9. Monitor data traffic.<\/strong><\/p>\n

Law firms should consider installing controls that alert information security personnel when there is a large spike of outward data transfer, or an unusual amount of files accessed by an employee as compared to a normal working day. An intrusion detection system can warn about malicious activities or violations of security protocols.<\/p>\n

10. Test for vulnerabilities.<\/strong><\/p>\n

Antivirus software is not enough to safeguard against today\u2019s sophisticated attackers. IT personnel should monitor firewall and other system logs and conduct regular penetration testing and auditing. Many firms have retained an external security vendor to perform periodic intrusion testing of their networks to identify potential vulnerabilities.\u00a0 Many corporations demand this from their third party providers and increasingly, law firms fall into this category.<\/p>\n

11. Assess vendor data access.<\/strong><\/p>\n

Before law firms give third parties access to client data, a thorough review of the vendor\u2019s policies is necessary. Vendors must contractually agree to follow the law firm\u2019s protocols and should employ features to safeguard data against unauthorized access, including encryption and password protection. Regular assessments and audits of vendor security practices ensure compliance with contractual agreements and latest security best practices. Using an external consulting firm to assess the vendors\u2019 security practices is an extension of the corporate expectations placed on the law firm itself.<\/p>\n

11.5. Constantly re-evaluate your firm\u2019s security posture.<\/strong><\/p>\n

Data security risks are ever-changing; so must be law firms\u2019 tactics to meet them. The data security team should meet regularly to evaluate evolving threats and confirm that their policies are following the latest security best practices.<\/p>\n

Implementing these 11.5 strategies can create a strong data security foundation that lessens threats and mitigates the risk of reputational damage and economic fallout in the event of a breach. Moreover, it can make firms more appealing to prospective clients who want to ensure the safest haven for their most important information.<\/p>\n<\/div>

<\/div><\/div><\/div><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":11,"featured_media":0,"menu_order":0,"template":"","format":"standard","meta":{"footnotes":""},"portfolio_category":[1022,1020,1027,724,824,192,720,419,943,719,177],"portfolio_skills":[245],"portfolio_tags":[1108,1109,1116],"yoast_head":"\nEye on Discovery - 11.5 Million Reasons for Law Firms to Take Data Security Seriously - Consilio.com<\/title>\n<meta name=\"description\" content=\"In early April, we bore witness to what may be the largest data breach in history: 11.5 million confidential documents spanning 40 years were leaked from Panamanian law firm Mossack Fonseca to German newspaper S\u00fcddeutsche Zeitung.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/uk.consilio.com\/resource\/eye-on-discovery-11-5-million-reasons-for-law-firms-to-take-data-security-seriously\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Eye on Discovery - 11.5 Million Reasons for Law Firms to Take Data Security Seriously\" \/>\n<meta property=\"og:description\" content=\"In early April, we bore witness to what may be the largest data breach in history: 11.5 million confidential documents spanning 40 years were leaked from Panamanian law firm Mossack Fonseca to German newspaper S\u00fcddeutsche Zeitung.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/uk.consilio.com\/resource\/eye-on-discovery-11-5-million-reasons-for-law-firms-to-take-data-security-seriously\/\" \/>\n<meta property=\"og:site_name\" content=\"Consilio.com\" \/>\n<meta property=\"article:modified_time\" content=\"2021-04-14T07:30:21+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/uk.consilio.com\/resource\/eye-on-discovery-11-5-million-reasons-for-law-firms-to-take-data-security-seriously\/\",\"url\":\"https:\/\/uk.consilio.com\/resource\/eye-on-discovery-11-5-million-reasons-for-law-firms-to-take-data-security-seriously\/\",\"name\":\"Eye on Discovery - 11.5 Million Reasons for Law Firms to Take Data Security Seriously - Consilio.com\",\"isPartOf\":{\"@id\":\"https:\/\/uk.consilio.com\/#website\"},\"datePublished\":\"2016-04-28T19:35:16+00:00\",\"dateModified\":\"2021-04-14T07:30:21+00:00\",\"description\":\"In early April, we bore witness to what may be the largest data breach in history: 11.5 million confidential documents spanning 40 years were leaked from Panamanian law firm Mossack Fonseca to German newspaper S\u00fcddeutsche Zeitung.\",\"breadcrumb\":{\"@id\":\"https:\/\/uk.consilio.com\/resource\/eye-on-discovery-11-5-million-reasons-for-law-firms-to-take-data-security-seriously\/#breadcrumb\"},\"inLanguage\":\"en-UK\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/uk.consilio.com\/resource\/eye-on-discovery-11-5-million-reasons-for-law-firms-to-take-data-security-seriously\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/uk.consilio.com\/resource\/eye-on-discovery-11-5-million-reasons-for-law-firms-to-take-data-security-seriously\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/uk.consilio.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Portfolio\",\"item\":\"https:\/\/uk.consilio.com\/resource\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Eye on Discovery – 11.5 Million Reasons for Law Firms to Take Data Security Seriously\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/uk.consilio.com\/#website\",\"url\":\"https:\/\/uk.consilio.com\/\",\"name\":\"Consilio.com\",\"description\":\"International eDiscovery and Managed Review Provider\",\"publisher\":{\"@id\":\"https:\/\/uk.consilio.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/uk.consilio.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-UK\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/uk.consilio.com\/#organization\",\"name\":\"Consilio\",\"url\":\"https:\/\/uk.consilio.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-UK\",\"@id\":\"https:\/\/uk.consilio.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/uk.consilio.com\/wp-content\/uploads\/2020\/10\/ConsilioBlueLogo.png\",\"contentUrl\":\"https:\/\/uk.consilio.com\/wp-content\/uploads\/2020\/10\/ConsilioBlueLogo.png\",\"width\":153,\"height\":51,\"caption\":\"Consilio\"},\"image\":{\"@id\":\"https:\/\/uk.consilio.com\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Eye on Discovery - 11.5 Million Reasons for Law Firms to Take Data Security Seriously - Consilio.com","description":"In early April, we bore witness to what may be the largest data breach in history: 11.5 million confidential documents spanning 40 years were leaked from Panamanian law firm Mossack Fonseca to German newspaper S\u00fcddeutsche Zeitung.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/uk.consilio.com\/resource\/eye-on-discovery-11-5-million-reasons-for-law-firms-to-take-data-security-seriously\/","og_locale":"en_US","og_type":"article","og_title":"Eye on Discovery - 11.5 Million Reasons for Law Firms to Take Data Security Seriously","og_description":"In early April, we bore witness to what may be the largest data breach in history: 11.5 million confidential documents spanning 40 years were leaked from Panamanian law firm Mossack Fonseca to German newspaper S\u00fcddeutsche Zeitung.","og_url":"https:\/\/uk.consilio.com\/resource\/eye-on-discovery-11-5-million-reasons-for-law-firms-to-take-data-security-seriously\/","og_site_name":"Consilio.com","article_modified_time":"2021-04-14T07:30:21+00:00","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/uk.consilio.com\/resource\/eye-on-discovery-11-5-million-reasons-for-law-firms-to-take-data-security-seriously\/","url":"https:\/\/uk.consilio.com\/resource\/eye-on-discovery-11-5-million-reasons-for-law-firms-to-take-data-security-seriously\/","name":"Eye on Discovery - 11.5 Million Reasons for Law Firms to Take Data Security Seriously - Consilio.com","isPartOf":{"@id":"https:\/\/uk.consilio.com\/#website"},"datePublished":"2016-04-28T19:35:16+00:00","dateModified":"2021-04-14T07:30:21+00:00","description":"In early April, we bore witness to what may be the largest data breach in history: 11.5 million confidential documents spanning 40 years were leaked from Panamanian law firm Mossack Fonseca to German newspaper S\u00fcddeutsche Zeitung.","breadcrumb":{"@id":"https:\/\/uk.consilio.com\/resource\/eye-on-discovery-11-5-million-reasons-for-law-firms-to-take-data-security-seriously\/#breadcrumb"},"inLanguage":"en-UK","potentialAction":[{"@type":"ReadAction","target":["https:\/\/uk.consilio.com\/resource\/eye-on-discovery-11-5-million-reasons-for-law-firms-to-take-data-security-seriously\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/uk.consilio.com\/resource\/eye-on-discovery-11-5-million-reasons-for-law-firms-to-take-data-security-seriously\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/uk.consilio.com\/"},{"@type":"ListItem","position":2,"name":"Portfolio","item":"https:\/\/uk.consilio.com\/resource\/"},{"@type":"ListItem","position":3,"name":"Eye on Discovery – 11.5 Million Reasons for Law Firms to Take Data Security Seriously"}]},{"@type":"WebSite","@id":"https:\/\/uk.consilio.com\/#website","url":"https:\/\/uk.consilio.com\/","name":"Consilio.com","description":"International eDiscovery and Managed Review Provider","publisher":{"@id":"https:\/\/uk.consilio.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/uk.consilio.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-UK"},{"@type":"Organization","@id":"https:\/\/uk.consilio.com\/#organization","name":"Consilio","url":"https:\/\/uk.consilio.com\/","logo":{"@type":"ImageObject","inLanguage":"en-UK","@id":"https:\/\/uk.consilio.com\/#\/schema\/logo\/image\/","url":"https:\/\/uk.consilio.com\/wp-content\/uploads\/2020\/10\/ConsilioBlueLogo.png","contentUrl":"https:\/\/uk.consilio.com\/wp-content\/uploads\/2020\/10\/ConsilioBlueLogo.png","width":153,"height":51,"caption":"Consilio"},"image":{"@id":"https:\/\/uk.consilio.com\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/uk.consilio.com\/wp-json\/wp\/v2\/avada_portfolio\/36915"}],"collection":[{"href":"https:\/\/uk.consilio.com\/wp-json\/wp\/v2\/avada_portfolio"}],"about":[{"href":"https:\/\/uk.consilio.com\/wp-json\/wp\/v2\/types\/avada_portfolio"}],"author":[{"embeddable":true,"href":"https:\/\/uk.consilio.com\/wp-json\/wp\/v2\/users\/11"}],"version-history":[{"count":0,"href":"https:\/\/uk.consilio.com\/wp-json\/wp\/v2\/avada_portfolio\/36915\/revisions"}],"wp:attachment":[{"href":"https:\/\/uk.consilio.com\/wp-json\/wp\/v2\/media?parent=36915"}],"wp:term":[{"taxonomy":"portfolio_category","embeddable":true,"href":"https:\/\/uk.consilio.com\/wp-json\/wp\/v2\/portfolio_category?post=36915"},{"taxonomy":"portfolio_skills","embeddable":true,"href":"https:\/\/uk.consilio.com\/wp-json\/wp\/v2\/portfolio_skills?post=36915"},{"taxonomy":"portfolio_tags","embeddable":true,"href":"https:\/\/uk.consilio.com\/wp-json\/wp\/v2\/portfolio_tags?post=36915"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}