Law firms are valuable targets for a multitude of reasons, but most recently they have been targeted as law firms are increasingly transitioning data to cloud-based platforms and web-based apps. While these technologies facilitate data accessibility, they also expand the attack surface and significantly increase the probability of vulnerabilities.
While these new technologies facilitate the storage of large tranches of client data and personal information, many firms fail to adhere to standards and best practices, despite increased regulatory mandates and legislation governing the protection of customer data.
Technologies notwithstanding, given the sophistication and sheer volume of ransomware attacks, it is critical to understand how ransomware attacks occur and the importance of a rigorous defense, if your firm is subject to a ransomware attack, it is critical to have a response strategy in place.
Ransomware is a deliberate cyber-attack designed to deny access to critical data and systems.
In a ransomware attack, a cybercriminal will gain credentials to log into the network. Often these credentials are procured via a phishing attack or a similar event in which an unwitting employee has shared login information with the perpetrator.
Upon gaining access, the trespassers often embed scripts designed to be activated at a later point in time. These scripts provide access to the firm's data and infrastructure when activated. Cybercriminals then demand a ransom payment, usually in the form of Bitcoin or another untraceable cyber currency.
Increasingly, criminals are also exfiltrating – or stealing – data, creating a second method of extortion, one to regain system access and the other to destroy the stolen data.
There are multiple considerations for law firms when it comes to countering these attacks. The consequences of these considerations are critical. First, and foremost, are the financial consequences of unsecured data. Ransomware attacks usually result in ransom demands of hundreds of thousands or often, millions of dollars.
Additionally, there are ancillary financial implications to consider. Among these are forensics analysis to determine the origin(s) of the attacks, breach response efforts to notify clients and employees, as well as fees for mitigation and monitoring.
Cyberattack damages are often devastating, including reputational damages that undermine the trust and foundation of the entire firm. Law practices have an ethical obligation to maintain confidentiality for their clients. There are also potential legal implications of ransomware. Information seized in a ransomware attack can be damaging to those clients if leaked.
There are numerous technological, procedural, and educational steps law firms can take to prevent ongoing attacks. In determining the best strategy, law firms should review their technology and preparedness frequently and invest in the tools and training designed to minimize the risk. Developing cybersecurity policies and practices for law firms is an essential requirement for ransomware prevention.
Here are some of the key steps to take as part of a comprehensive cybersecurity plan:
If someone were to be the victim of a ransomware attack, they would likely receive communication from the attackers, who would demand a ransom in exchange for regaining access to their data.
When faced with the sudden loss of your data, law firms need to be able to act fast. While most law firms end up paying the ransom, many law firms use outside experts to decrypt the data or have recent backups that mitigate the damage.
If you do choose to negotiate with hackers, please keep in mind the following dos and don’ts:
Ransomware attacks are an ever-present danger for law firms. Only by fully understanding the mechanics, prevention, and implications of an attack, will your firm be in a stronger defensive position.
Janus Associates offers comprehensive cybersecurity consultative services that allow for your firm to be prepared and ready. To learn more about Janus Associates’ services, contact us today.