Data Security is Non-Negotiable: Why the Recent Gmail Password Compromise Should Be a Wake-Up Call for Your Firm

One aspect of delivering top-tier legal service is the absolute security of client-confidential information. That's why the recent headlines about a massive collection of stolen data found online should be a wake-up call to law firms. This collection of stolen data contains millions of compromised email credentials, including a significant number of Gmail accounts.

Google has clarified that its own systems were not breached. They maintain that the leak is a result of widespread "infostealer" malware harvesting credentials from individual infected devices. However, in the end, the distinction doesn’t matter when it comes to the potential for client-confidential information to leak beyond a law firm using tools where the log-in credentials have been compromised.

The cybersecurity threat to law firm data is real, immediate, and squarely focused on any organization where attorneys and staff may use a personal Gmail for business correspondence, or, more critically, reuse their personal login for their professional accounts.

The Unique Risk for Law Firms

Law firms are no longer low-value targets; they are prime targets. Law firms maintain some of the most sensitive, privileged information imaginable: merger and acquisition (M&A) strategies, intellectual property secrets, financial records, litigation tactics, personally identifiable information (PII), and more. This makes a compromised email address a potential major threat to a law firm’s (and individual attorney’s) attorney-client privilege and fiduciary duty.

• “Credential Stuffing” is the Gateway: This is the most significant danger. If an employee uses the same password for their personal Gmail (now compromised) and their firm-issued account or a client portal (whether it is Gmail-based or  not), hackers will use the leaked credentials to "stuff" them into a firm’s more valuable systems. A successful login gives them the keys to an organization’s data.
• Ethical and Regulatory Liability: The American Bar Association (ABA) Model Rule of Professional Conduct 1.6 (https://bit.ly/ABAROPC1-6 ) imposes an ethical obligation on lawyers to make "reasonable efforts" to prevent the unauthorized disclosure of client information. A failure to enforce basic security measures like unique passwords and Multi-Factor Authentication (MFA) can be seen as a violation, leading to disciplinary action, massive financial damages, and class-action lawsuits. Case settlements stemming from data breaches in the legal sector are already soaring into the millions.
  • Judge gives final OK to $8M settlement in Orrick data breach
  • Houser LLP $1.3 Million Data Breach Class Action Settlement
  • Law Firm Settles Data Breach Lawsuit: A Warning for Legal Professionals

• The Chain of Trust Breaks: Clients trust law firms with their most sensitive data. The reputational damage from a breach—even one originating from a single reused password—can be irreparable. Once trust is broken, it's virtually impossible to rebuild.

Your Firm’s Action Plan: Non-Negotiable Security Steps

The news of this latest data breach is not a time for panic, but rather for decisive action. Law firms must immediately address the weakest link in their security chain: the human element and “password hygiene.”

1. Mandate Multi-Factor Authentication (MFA) Firm-Wide: The single most effective defense is Multi-Factor Authentication. MFA should be mandatory for every system: firm email, VPN, client portals, cloud storage network-connected voicemail systems, etc. A stolen password is useless if the attacker can't pass the second authentication step on a trusted device.
2. Enforce Unique and Strong Passwords: No more re-using passwords. Period. Law firms should mandate the use of a secure password manager for all employees to generate and store complex, unique credentials for every service.
3. Run an Immediate Credential Audit: Encourage or even mandate staff to use services like Have I Been Pwned to check any personal email addresses. Personal accounts should be checked whether or not those personal accounts are used for firm-related sign-ups, since many people reuse usernames and passwords across their work and personal accounts. If a personal account is compromised, the associated business accounts must have their passwords reset immediately.
4. Security Awareness Training (Again): This is not a one-and-done event. Law firms should have regularly-scheduled training sessions focused on the dangers of credential reuse and phishing, and more specifically on infostealer malware. One emphasis of this training should be that hackers are not just targeting the firm's main server; they are targeting firm employees as individuals to gain access.

The digital landscape is ever-changing. Cybercriminals are persistent, and nation-state actors are actively targeting US law firms for corporate and national security intelligence. Lawyers’ professional obligations demand that data security is treated with the same rigor and dedication law firms apply to their most complex legal cases.

No matter the cost of proactive security, it is always negligible when compared to the cost of a data breach.

The post Data Security for Law Firms is Non-Negotiable: Why the Recent Gmail Password Compromise Should Be a Wake-Up Call for Your Firm appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

The announcement cited security upgrades in newer versions of the browser as a reason for not supporting versions of Chrome before version 53.  “Starting February 8, 2017, we will show a banner at the top of the Gmail interface for users who are still on Google Chrome Browser v53 and below to encourage upgrading to the latest version of Chrome,” Google said in a blog post.

In case you needed another reason to upgrade to a modern operating system, the newest version of the Chrome browser for the Windows XP and Windows Vista operatong systems, as well as Mac OS 10.8 is version 49. Neither Windows XP or Windows Vista are still supported by Microsoft.

You can download the current version of the Google Chrome browser here.

The post Gmail Will Stop Working on These Browsers Soon appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

According to Google, "[the] new name ... better reflects [their] mission.

The G Suite is a paid version of the tools also available to registered users of Google's free Gmail, including:

• Gmail
• Google Calendar
• Google Docs
• Google Drive
• Google Hangouts

The paid version adds business-specific features such as:

• custom email addresses at your domain (@yourcompany.com)
• at least 30 GB of storage for documents and email (more storage can be purchased)
• 24/7 phone and email support
• administration/management dashboard

The change has no real effect on end-users. We have not seen any changes yet in the functionality of the individual applications in the suite or the administrative dashboard. End-users aren't even seeing the new logo (seen above).

Over it's lifetime, the product has been known by a variety of names, including:

• Google Docs
• Google Apps for Your Domain
• Google Apps 
• Google for Work
• G Suite

(If we've forgotten one, please let us know.) 

The post Google Introduces (Yet Another) New Name for Google for Work appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

Now, Google has introduced a

The post Google Introduces New Email Security Warning in Gmail appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

Over the course of the past few weeks, Google has been rolling out the feature to email addresses in Work accounts. Not all accounts have the feature added yet, so if you don't see it in your account yet, stay tuned.

The first time events are auto-added to your calendar, you'll see a pop-up in your calendar explaining the feature.

Google will also send you an email listing those events. Similar messages are not sent when new events are auto-added after this first time.

Because Gmail is auto-detecting events based on the text of the messages, there is room for potential error. In the initial creation of events from my recent emails, Google got all 17 of my upcoming flights correct (including arrival and departure times [even recognizing the local time zones], as well as confirmation numbers). However, it did also add a hotel stay to my calendar that was generated from an email advertising a conference I did not plan on attending.

Automatically added events are only visible to the calendar owner and not people with whom a calendar is shared. Once the events are added to your Calendar, you can change the Sharing settings for individual events.

The feature can be turned off in the Google Calendar Settings menu.

Events from Gmail is not available to Google Apps for Government accounts.

The post New Gmail Events Feature Finally Comes to Google for Work Accounts appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

Google's new "Insert Photo" button, in the Gmail compose window, gives users access to the images they have stored in their Google+ profile.

Clicking the button opens a new window that displays all of the photos stored as part of your Google+ profile (both public and private).

• Click on individual photos to elect one or more to include in the email message. 
• Use the buttons in the lower right-hand corner to indicate whether the photos should be included as attachments to the message or embedded in the message ("Inline")
• Click the "Insert" button to add the photo(s) to your email.

The post Gmail Makes Access to Mobile Device Photos Easier | Google Adds One Button Image Integration appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

Monday February 3, 2014

1:00 - 2:30 pm Eastern

This CLE program on Google Gmail and Calendar will teach you, in plain English, how to transform your law practice by using two of Google's low-cost but powerful tools -- Gmail and Calendar -- to save time and money, and improve communication and collaboration with clients and colleagues. You will learn all about the various functions and features of Gmail and Calendar, as well as several related services and plug-ins that can SUPERCHARGE your Gmail/Calendar experience. Levitt and Rosch will also discuss ethical concerns about security and confidentiality when using Google Gmail and Calendar.

Need ethics credit? This seminar qualifies for 1.5 to1.8 credit hours, including 0.5 to 0.6 ethics credit hours, depending on state requirements, in MCLE jurisdictions that accredit live telephone seminars and/or webcasts on law practice management topics. Click here for a full list of jurisdictions in which this MCLE course is accredited.

Bonus! All registrants will receive a FREE copy of Carole Levitt and Mark Rosch’s e-book, Google Gmail and Calendar in One Hour for Lawyers (a $39.95 value) In addition, all registrants receive a set of downloadable course materials and free access to the archived online program later.

The post Webinar – Google Gmail and Calendar Tips and Tricks Online CLE February 3, 2014 appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

A little over two years ago, in an effort to unify the design of all of its products, Google added a standardized black bar across the top of all of those products. In that black bar (in easily ignored grey text) were links to some of Google’s most popular products and specialized databases.

The goal was to give users access to those popular products in one or two (and sometimes three) clicks.

Google has been rolling out a new App launcher on the upper right-hand side of its Web Search homepage (and other products) as a replacement to the black bar - to access those same products. The new App launcher is reminiscent of design elements of Google’s Chrome operating system. The new App launcher adds at least one click (and sometimes more) to the process of accessing those products. For example, to reach the journal and caselaw databases at Google Scholar now requires users to:

• click the App launcher on the upper right-hand side of their browser window;
• scan down to the bottom of the list presented
• click the More link
• scan down to the bottom of the subsequent list presented
• click the Even more from Google link
• scroll down the list of products presented and locate the link to Google Scholar

Links to access Gmail and Google’s Image Search are still located in the upper right-hand corner of the Web Search interface.

Users could use direct URLs (e.g., https://www.google.com/scholar) to access products like Google Scholar or create browser Favorites or Shortcuts.

The black bar interface still displays on the search results page(s) for some Google products such as Google Groups.

However, if Google’s goal was to make the products on the More and Even More screens easier to access we don’t see this update as an improvement.

The post Google Changes Search Page Interface – Again appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

Google has created a new account management tool that allows you to dictate who has access to your account if it becomes inactive - like in the event you die. The new Inactive Account Manager gives you the ability to decide what happens to your photos, emails, and documents after you stop using your account for a pre-determined length of time.

You can opt to share access to your data with a select friend (or friends) or family member(s) - up to 10. You can also choose to have your account deleted entirely. 

Google's Inactive Account Manager gives you the following options. You can also:

• be alerted by mobile phone or (non-Google) e-mail before any actions are taken on your account
• set a timeout period of inactivity, between three months and one year, after which the individuals you designated would be notified they can access your account

Note that the Google Inactive Account Manager is not available for Google Apps for Business accounts. Google Apps for Business accounts (generally) remain the property of the Busines owner and not the end users/employee.

The post Manage Your Gmail From the Grave | Google’s Inactive Account manager appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

Google provides a chart to check the status of any of its Apps.

Color coded dots indicate the current status of each service.

• Green indicates "no issues."
• Yellow indicates a "service disruption."
• Red indicates a "service outage."

Clicking a yellow or red dot takes you to a "Service Details" page that outlines the issues surrounding the disruption or outage.

Links are also included on the "Service Details" page to "Incident Reports" containing more detailed information abaout the disruption or outage.

Apps tracked on the chart include:

• Google Mail
• Google Calendar
• Google Talk
• Google Docs List
• Google Documents
• Google Spreadsheets
• Google Presentations
• Google Drawings
• Google Sites
• Google Video for business
• Google Groups Admin control panel / API
• Postini Services

The post Google Apps Provides Status Checker appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.