Just like any other business in this day and age, law firms face a new breed of criminal: cyber-based criminals. Cyber-attacks and data breaches have increased over 700% since February last year in Australia. Despite this, companies and employees are more often than not, untrained, uneducated and ill-equipped to deal with such attacks.
What are the most common cybersecurity threats that a law firm faces?
There are a variety of strategies that these criminals employ; these strategies include but are not limited to:
- Social Engineering
- Data Breaches
- Zero-day Exploits
What actions can be taken to implement a defence strategy in your law firm?
Having a defence strategy in place is crucial when it comes to cybersecurity. All businesses, law firms included, should have a defence strategy in place, to avoid being caught on the back-foot. Attacks can’t always be prevented but certain steps can be taken to try to mitigate the harm caused by these attacks, or to avoid them entirely.
There are six simple steps that I would recommend every business take when it comes to cybersecurity:
- Have a strategy in place:
This sounds simple, yet it’s not all that common in small-medium businesses. First and foremost, when trying to protect a business against a cyber-attack, a business should have a strategy in place, should the day ever come, or to prevent that day from coming.
- Educate employees:
All employees should have rudimentary knowledge about being safe online and the different attack vectors that these criminals are able exploit when targeting individuals and businesses. Knowledge is power.
- Two-factor Authentication (2FA):
2FA adds an extra layer of protection to accounts. Simply using a password will not suffice when attempting to login to account that has 2FA enabled. If somebody happens to guess your password or there is a data breach in which your password has been leaked, they won’t be able to just use those details to access your account if 2FA is enabled. Email and phone verification are common forms of 2FA, but Google also offers GAuth (Google Authenticator). Email and phone 2FA are less secure than the latter because these both are easier to hijack; with that being said, something is always better than nothing.
It is important to use a complex password where passwords are required – this includes the use of lower case and capital letters, numbers and characters. A one-word password will not cut it nowadays. A method of cracking simple passwords is bruteforcing. A bruteforcing attack attempts to login with every possible password combination that there is. The more complex a password is, the more difficult it will be to bruteforce. There are tools available online to assess how secure your password is and how long it would take to crack, such as this tool. See below for an example:
It is also important for individuals to regularly check if their private information has been leaked in a data breach. This can be done via websites like HaveIBeenPwned, as seen below:
Using a different password on each different platform is recommended for this reason. Should one account be accessed without authorisation, your other accounts won’t necessarily be. If you see that your details have been leaked in a data breach, it is important to remain calm. You should act swiftly and secure all of your accounts.
- Avoid emailing impersonation attempts:
Most email platforms (eg. Gmail and Outlook) allow for detection and prevention of email impersonation attempts. It is crucial to make sure that the email platform that you use offers this protection. Emailing spoofing gives the cybercriminal the ability to make an email appear as if it is coming from somebody that it is not. These attacks are typically doubled with an attachment containing malware, a request for sensitive information or fake login page (phishing attack). In more advanced email spoofing attacks, the attacker will pose as an authority figure which can be very misleading, but the good news is that these emails can generally be detected before they reach the individual.
- Anti-virus software and web browser protection:
Selecting the right protection software is crucial when trying to mitigate cyber-attacks. The cheaper software usually doesn’t offer what the premium products offer. This is an instance where the price generally has a direct correlation with the quality of product. Whilst the anti-virus software that you are current using may do just that, protect you from viruses and malware, it may not protect you from the more advanced attacks. A good anti-virus program will protect you from viruses, but also safeguard your computer from undetectable malware, infected files and ransomware attacks. Additionally, effective anti-virus software will also provide you with a DNS (domain name service) firewall. DNS protection protects devices inside and outside the office, from a variety of different attacks.
Overview cybersecurity, law firms and you
Cybercriminals are getting smarter and more brazen. They will generally go after a target that has a weak first line of defence – it doesn’t matter whether you are an individual or a large company. For this reason, it is important to have a defence strategy in place and to attempt to stay one step ahead of the criminals.
Cyber-attacks can’t always be prevented, so it is important not to blame yourself if such an incident does occur. If Google and Sony can be attacked, you can too. Given all of this, you should have a damage-control process in place in the event of you or your business being breached.