Tag Archives: hacking

Attorneys and Law Firms Beware and Implement Good Cyber Security Practices

If you are an attorney you need to heed the warnings: lock down and protect client data.  This is not a scare tactic, but good advice in light of recent events.  In 2010 at least seven law firms in Canada were hacked, allegedly by Chinese hackers seeking to derail a $40 billion deal with an Australian mining company and to steal valuable client data resident at the law firms; and just this year the Puckett law firm was hacked by the Anonymous hacker group because the firm represents one of the Marine sergeants accused in the Hidatha, Iraq killings.  Some members of Anonymous were upset that the sergeant was getting a pretty good deal and Bradley Manning, the private who leaked      secrets to WikiLeaks was facing life in prison.  Imagine realizing that your law firm has been hacked and wondering what this is going to do to your reputation, and what, if any, ethics or disciplinary action may result. These are the type of stories that make the headlines.

Let’s face it, if your client’s network and/or data is secure, smart hackers will look for the soft target and see if they can get what they are looking for by going through you.  “As financial institutions in New York City and the world become stronger, a hacker can hit a law firm and it’s a much, much easier quarry.” (Mary Galligan, head of cyber in the New York City office of the FBI).  As a profession, we have moved far beyond being able to claim ignorance when it comes to cyber security.

An Aug. 2011 ABA formal opinion suggested that attorneys discuss with clients the fact that email may not be very secure.  Ensure clients are comfortable sending sensitive client info via email.  Some local bar associations have taken it a step further and stated that ethics require attorneys to use a secure email service.  I agree.  In fact, I would do two things:

1) include in your engagement letter a statement that email is not secure and that clients should either agree to use a secure service or sign a statement indicating their desire to continue to use email despite the security concerns; and,

2) Incorporate into a security policy for the firm a plan that outlines how client data will be protected and ensure all in the firm have read and are following it.

Cyber security does not need to be a mystery.  Many free and easy to use tools exist that will help you keep your practice more secure.  For instance, your email service may support secure or encrypted email.  If it doesn’t, there are many good options, such as Hushmail.  It is free, like Hotmail, and allows you to password protect emails using a question and answer format.  Just send your client a text or call them on the phone and tell them the password/answer.  This will significantly lower the risk of loss or theft of data and potentially reduce or eliminate your liability if an incident does occur.  It will also be a deterrent to your client if he/she decides to share your confidential communications with a third party, thus destroying attorney-client confidentiality. He/she will have to provide the password to that person or at least take extra steps to forward the message.  This is just one of many free tools that you can use to significantly lower the risk of a cyber-incident and reduce your liability if data is lost or stolen.  Will these tools make you 100% secure?  Not even close, but if the big guys like Citibank, JP Morgan, Google, the Pentagon, RSA, Visa, and a slew of others cannot prevent getting hacked neither can you.  What you can do is pull yourself out of the low hanging fruit category and minimize the risk of an incident. It’s time to do some research into this topic or hire someone you can trust.  Do Not trust the firm that tells you they have made your network secure, its not going to happen, and if you believe it there is a little bridge I would love to sell you ; – ).  Feel free to contact me with questions or leave a comment.

Hacking Back Part II

In my last blog on “Hacking Back” I asked is it legal, ethical, and do I have a right to defend my network against yours? Well, I believe it is legal and ethical, and absolutely, I have the right under “self-defense” to defend my network from being attacked by yours, even if you do not know that your network is attaching mine!

Obviously if I know who you are and can contact you I would be obligated to do so. This scenario assumes I have no idea where the attack is coming from.

When considering hacking, hack back, self-defense in cyber space, etc., you must consider the fact that everything happens literally at the speed of light. So, saying I must contact law enforcement, collect evidence, and go to court is the same as saying “just accept it, and hope to recover all of your losses from a court, even if your company has since been put out of business.”

Here is my next question for comments:

Does anyone wish to argue that if their network has been compromised by hackers and is attacking others without their knowledge, the party or parties they are attacking have NO right to take action to stop those attacks?

My hacking back article can be found on Titan Info Security Group under white papers.