Data Security is Non-Negotiable: Why the Recent Gmail Password Compromise Should Be a Wake-Up Call for Your Firm

One aspect of delivering top-tier legal service is the absolute security of client-confidential information. That's why the recent headlines about a massive collection of stolen data found online should be a wake-up call to law firms. This collection of stolen data contains millions of compromised email credentials, including a significant number of Gmail accounts.

Google has clarified that its own systems were not breached. They maintain that the leak is a result of widespread "infostealer" malware harvesting credentials from individual infected devices. However, in the end, the distinction doesn’t matter when it comes to the potential for client-confidential information to leak beyond a law firm using tools where the log-in credentials have been compromised.

The cybersecurity threat to law firm data is real, immediate, and squarely focused on any organization where attorneys and staff may use a personal Gmail for business correspondence, or, more critically, reuse their personal login for their professional accounts.

The Unique Risk for Law Firms

Law firms are no longer low-value targets; they are prime targets. Law firms maintain some of the most sensitive, privileged information imaginable: merger and acquisition (M&A) strategies, intellectual property secrets, financial records, litigation tactics, personally identifiable information (PII), and more. This makes a compromised email address a potential major threat to a law firm’s (and individual attorney’s) attorney-client privilege and fiduciary duty.

• “Credential Stuffing” is the Gateway: This is the most significant danger. If an employee uses the same password for their personal Gmail (now compromised) and their firm-issued account or a client portal (whether it is Gmail-based or  not), hackers will use the leaked credentials to "stuff" them into a firm’s more valuable systems. A successful login gives them the keys to an organization’s data.
• Ethical and Regulatory Liability: The American Bar Association (ABA) Model Rule of Professional Conduct 1.6 (https://bit.ly/ABAROPC1-6 ) imposes an ethical obligation on lawyers to make "reasonable efforts" to prevent the unauthorized disclosure of client information. A failure to enforce basic security measures like unique passwords and Multi-Factor Authentication (MFA) can be seen as a violation, leading to disciplinary action, massive financial damages, and class-action lawsuits. Case settlements stemming from data breaches in the legal sector are already soaring into the millions.
  • Judge gives final OK to $8M settlement in Orrick data breach
  • Houser LLP $1.3 Million Data Breach Class Action Settlement
  • Law Firm Settles Data Breach Lawsuit: A Warning for Legal Professionals

• The Chain of Trust Breaks: Clients trust law firms with their most sensitive data. The reputational damage from a breach—even one originating from a single reused password—can be irreparable. Once trust is broken, it's virtually impossible to rebuild.

Your Firm’s Action Plan: Non-Negotiable Security Steps

The news of this latest data breach is not a time for panic, but rather for decisive action. Law firms must immediately address the weakest link in their security chain: the human element and “password hygiene.”

1. Mandate Multi-Factor Authentication (MFA) Firm-Wide: The single most effective defense is Multi-Factor Authentication. MFA should be mandatory for every system: firm email, VPN, client portals, cloud storage network-connected voicemail systems, etc. A stolen password is useless if the attacker can't pass the second authentication step on a trusted device.
2. Enforce Unique and Strong Passwords: No more re-using passwords. Period. Law firms should mandate the use of a secure password manager for all employees to generate and store complex, unique credentials for every service.
3. Run an Immediate Credential Audit: Encourage or even mandate staff to use services like Have I Been Pwned to check any personal email addresses. Personal accounts should be checked whether or not those personal accounts are used for firm-related sign-ups, since many people reuse usernames and passwords across their work and personal accounts. If a personal account is compromised, the associated business accounts must have their passwords reset immediately.
4. Security Awareness Training (Again): This is not a one-and-done event. Law firms should have regularly-scheduled training sessions focused on the dangers of credential reuse and phishing, and more specifically on infostealer malware. One emphasis of this training should be that hackers are not just targeting the firm's main server; they are targeting firm employees as individuals to gain access.

The digital landscape is ever-changing. Cybercriminals are persistent, and nation-state actors are actively targeting US law firms for corporate and national security intelligence. Lawyers’ professional obligations demand that data security is treated with the same rigor and dedication law firms apply to their most complex legal cases.

No matter the cost of proactive security, it is always negligible when compared to the cost of a data breach.

The post Data Security for Law Firms is Non-Negotiable: Why the Recent Gmail Password Compromise Should Be a Wake-Up Call for Your Firm appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

For lawyers looking for more detailed information, we are offering a free one-hour program detailing hardware, software, and security issues lawyers should be aware of if they are considering a short- or long-term shift to working remotely.

Read Clio's blog post.

Earn Continuing Legal Education (CLE) Credit

Lawyers can also learn more specific information about using some of these legal technology tools and avoiding some of the potential ethical pitfalls that accompany them  - and earn CLE credit while they do it. 

The post Resources for Lawyers Working Remotely appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

While a solid majority of respondents to the 2018 Survey (88.2%) reported being comfortable with their firm’s technology, they also appear to have lost ground regarding the availability of training in their firms. Only a slim majority of respondents (56.9%) indicated that there was technology training of any kind available at their firm. This is a marked decline from the 74.3% of respondents who responded affirmatively in 2017, 70.5% in 2016, and 67% in 2015.

Internet For Lawyers' principal Mark Rosch takes a deep dive into the responses and what they mean for lawyers in this analysis of the results for the American Bar Association's Legal Technology Resource Center.

The post American Bar Association Releases Lawyer Technology Training Survey Results appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.