Cybersecurity

Tech Savvy

Improve your cybersecurity without a Ph.D.

By Claude Ducloux

Nothing strikes terror into the heart of a busy practitioner like the haunting fear of losing client information due to inadequate digital security. Hacking, viruses, and the increasing danger of ransomware present challenges never before experienced by our legal predecessors, who could keep client information safely under lock and key.

The facts and figures about cyber losses across the country are startling: An estimated $325 million to ransomware alone in 2015, with a predicted increase to $11.5 billion in 2019. Cybersecurity Market Report, an online publication, estimates that cybercrime damages will exceed $6 trillion annually by 2021. We have already seen a string of law firms breached in 2015-2016 to obtain secrets on upcoming mergers and acquisitions. With each breach, lawyers stand to lose sensitive information, business disruption, and the complete loss of client trust.

Where Do We Start?
What steps can we take that make sense, and, more importantly, steps that are understandable to the average practitioner, who has good intentions but a limited budget to employ experts?

First, let’s understand the problem: The “insider threat” is the most significant risk that firms take. Giving all employees passwords and access to files mean that your employees can take digital copies out of the office, intentionally and often unintentionally, on thumb drives with more storage than ever before. Disgruntled employees account for roughly 20 percent of all lost or copied data that leave a business.

Second, our demand for 24/7 access from anywhere leads to leaks over unsecure Wi-Fi and information obtained from our lost devices.

Third, our reluctance to change our passwords, and to strengthen those we have, means most of us use the same combinations for all our sites, making it infinitely easier to hack our systems.

Let’s see how we can address these issues in some simple steps.

The Cyber-Asset Inventory
Every lawyer should make a template of each device used by the lawyers and their support staff. (Free templates are available for this purpose from several sources online, but you can easily create your own.) The list should include each computer and laptop, the owner, the user, and the make and model. If your firm uses mobile devices or tablets (e.g. iPads), those assets should be included in the inventory. Also identified are the internet service provider, or ISP, and the network hardware, and how it is configured. Do you have a separate guest Wi-Fi? Who has Wi-Fi access? Is each channel password protected? How often do you change those passwords?

The purpose of this inventory is to see who has access to which devices, and to see if all those people actually need access. Limiting access by changing and hardening passwords is a direct way to avoid the disgruntled employee from copying files for others. For example, few employees should have access to accounting information or bank accounts. Limit access whenever possible to those individuals who have a proven need to know.

A second purpose of this inventory is to ensure you are backing up information from all those devices in the case of a breach or virus. Seeing the number of devices on a page gives you checklist access to ensure each device has some means of regular backup. Also, it makes you decide where and who has access to those backups. The overall goal is to strengthen every asset in your office, limit employee access when access is not necessary, and make sure backups are updating.

Strengthening Passwords
Weak passwords are the easiest way to hack into private information. This includes networks, Wi-Fi, email, and all other accounts we are forced to use every day. The experts recommend using a password manager, which can generate very strong passwords, and you only need to remember one very strong password to access that manager program. As a general rule, in making our passwords we are told to avoid dictionary words, foreign words, slang or jargon, and names associated with you. We should use 12 or more characters, upper and lowercase, and numbers and symbols.

Dual Authentication
In our office, we are required to have 12-digit passwords changed every 90 days. Further, we have dual authentication if we’re logging in from another computer, which means every attempt to login sends a multi-digit code to our cellphones to ensure we are the person logging in. It only takes another 20 seconds, but it gives us a great sense of security. Gmail and most providers will enable dual authentication for added security.

Fortify Your Office Network
In my CLE lectures, I humorously advise, “Don’t let your 15 year old set up your Wi-Fi.” Sure, they’ll do a better job than you will but won’t employ the standards needed, nor change the manufacturer’s password. Always remember that the same rules should apply to your Wi-Fi as your email: generate a very strong password, require network authentication, and select Wireless Protected Access 2, or WPA2, for most small practices. Most importantly, make sure you have a separate guest network from your office network. Most routers support one or more guest networks. Don’t use a router that does not have separate guest network capability.

Simple Updates to Your Computers
Your office computers can be a treasure trove for an attacker, and there are multiple routes in, from open network connectivity to targeted malware. (A recent report revealed cybercriminals hacked an unnamed casino through its internet-connected thermometer in an aquarium in the lobby of the casino.) Fortunately, there are a few key tools at your disposal to counter these threats, and you should enable them. They include automatic updates, antivirus/anti-malware, and a firewall. Don’t automatically think these easy solutions have already been enabled. On Windows systems you can find them usually by going to “Control Panel?System Security” and enabling them. Most newer computers also do “whole-drive” encryption. Check to see if you have an encryption setting or ask your manufacturer.

Be Wary of Websites You Visit
Always remember to check that the website you’re visiting starts with “https” as that final “s” indicates it is secure.

Dealing With Clients
Most lawyers overlook this easy step during the client interview—always ask if the client has special security needs. Will you be handling intellectual property or other specific information that requires enhanced cybersecurity? If so, how would the client want that handled? It is reasonable to tell the client that you will use their special encryption software, but they must either provide it or reimburse you for installing it. This important but overlooked step was discussed in depth in American Bar Association Formal Opinion 477R, which was published in June 2017.

ABA Formal Opinion 477R
As technology advances, lawyers must determine whether it continues to be safe to send confidential information over the internet or whether additional security methods should be implemented.

The ABA restates the factors outlined in paragraph 18 of the Comment to Model Rule 1.6:

• The sensitivity of the information;

• The likelihood of disclosure if additional safeguards are not employed;

• The cost of employing additional safeguards;

• The difficulty of implementing the safeguards; and

• The adverse affect of the safeguards to the lawyer’s ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use).

Upon consideration of these factors, lawyers are directed to consider using these seven steps to help guard against disclosure:

1. Understand the nature of the threat. Consider the sensitivity of the client’s information and risk of cybertheft. If there is a higher risk, greater protections may be warranted.

2. Understand how client confidential information is transmitted and where it is stored. Understand how your firm manages and accesses client data. Be aware that use of multiple devices means multiple access points.

3. Understand and use reasonable electronic security measures. Use reasonable protections for client data. This may include security procedures such as using secure Wi-Fi, firewalls, and anti-spyware/anti-virus software and encryption.

4. Determine how electronic communications about clients’ matters should be protected. Discuss with the client the level of security that is appropriate when communicating electronically. If the information is sensitive or warrants extra security, consider safeguards such as encryption or password protection for attachments. Take into account the client’s level of sophistication.

5. Label client confidential information. Mark communications as privileged and confidential to put any unintended lawyer recipient on notice that the information is privileged and confidential. Once on notice, under Model Rule 4.4(b) Respect for Rights of Third Persons, the inadvertent recipient would be on notice to promptly notify the sender.

6. Train lawyers and non-lawyer assistants in technology and information security. Take steps to ensure that lawyers and support personnel in the firm are trained to use reasonably secure methods of communication with clients. Also, periodically reassess and update security procedures.

7. Conduct due diligence on vendors providing communication technology. Take steps to ensure that any outside vendor’s conduct comports with the professional obligations of the lawyer.

A full copy of this ABA Formal Opinion is downloadable and contains excellent discussions of security precautions.

Employee Training
At the very minimum, every law firm employee should be instructed on the nature of private information and admonished that the law requires that no such information leave the office in any form without the approval of the supervising attorney. In my own office, my longtime legal assistant knows that, no matter how well she knows the opposing counsel, she must check with me before any private sensitive information is transmitted or delivered from our client file.

The State Bar of Texas PDP-CLE Joint Resolution
The State Bar of Texas recognizes the critical nature of cybersecurity and the increasing importance that lawyers have a duty to achieve knowledge and technical skills in these areas. On April 18, 2018, at the joint meeting of the State Bar of Texas Committee on Legal Education and the Professional Development Committee, the members in attendance jointly and unanimously adopted a resolution acknowledging that:

WHEREAS, the practice of law is now inextricably intertwined with technology for the delivery of services, the docketing of legal processes, communications, and the storage and transfer of client information, including sensitive private and confidential information and other protected data;

and further relating that:

“the continued competency of Texas lawyers to deliver services, communicate, and protect such information is dependent on technology skills and competency;”

That the mission of CLE should include:

“… information on technology, technical skills, and the implementation required to operate in a manner which enhances the ethical and competent delivery of legal services, and the security of client information.”

The joint resolution further explains:

“… lawyers should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology, engage in continuing study and education and comply with all continuing legal education requirements to which the lawyer is subject.”

BE IT FURTHER RESOLVED: The above committees recommend that Texas Disciplinary Rule of Professional Conduct 1.01, comment 8 be revised as follows:

Maintaining Competence
8. Because of the vital role of lawyers in the legal process, each lawyer should strive to become and remain proficient and competent in the practice of law, including the benefits and risks associated with relevant technology. To maintain the requisite knowledge and skill of a competent practitioner, a lawyer should engage in continuing study and education. If a system of peer review has been established, the lawyer should consider making use of it in appropriate circumstances. Isolated instances of faulty conduct or decision should be identified for purposes of additional study or instruction.

RESOLVED and unanimously adopted this 18th day of April, 2018.
/s/Xavier Rodriguez, Chair, SBOT CLE Committee
/s/Gary L. Nickelson, SBOT PDP Committee

The resolution was considered by the State Bar Board of Directors and submitted to the Texas Supreme Court for consideration. On September 10, 2018, the court requested that the Committee on Disciplinary Rules and Referenda study the proposed amendment and make recommendations to the court.

Conclusion
The need to review and enhance your firm’s cybersecurity is real. But a respect for the cleverness of hackers and the continuing fiduciary duty you have to protect client information should result in good habits, good processes, and implementing some relatively easy improvements to your office security. Remember the old joke: “You’re not paranoid if people really are out to get you.” Having been a victim of a ransomware attack myself, I treat every incoming email with care and delete all suspicious messages immediately. If you do believe it is a real email, call the sender first when in doubt.^TBJ

CLAUDE DUCLOUX
is certified in civil trial and civil appellate law by the Texas Board of Legal Specialization. He serves on the Texas Supreme Court Committee on Disciplinary Rules and Referenda and is the national director of education and ethics for LawPay in Austin.

{Back to top}