This article appeared in Cybersecurity Law & Strategy, an ALM publication for privacy and security professionals, Chief Information Security Officers, Chief Information Officers, Chief Technology Officers, Corporate Counsel, Internet and Tech Practitioners, In-House Counsel. Visit the website to learn more.

While no amount of insurance can protect your reputation, you also can't buy yourself out of the cyber risks that threaten your reputation either. eSentire recently conducted research with 1,250 senior IT and security executives across financial, healthcare, legal, manufacturing, telecommunications, and other industries to gauge their risk tolerance, security maturity, and top risks.

The sample included more than 160 law firm executives (from medium to large firms), and we found that law firms were among some of the highest spenders on security yet were susceptible to some of the most common risks. And the issue will grow over the coming years as the demands of the business drive the adoption of emerging technologies, such as cloud and Artificial Intelligence (AI).

Law Firm Overall Spend on Security Is Among the Highest

Law firms rival their much larger counterparts, telecoms companies, when it comes to security spend as a percentage of IT spend. Lowest of any industry, non-firms reported spending less than 5% on security. Only 21% of firms spent between 5-10%; whereas 40% spent 11-30%, and 29% spent up to half of their IT budget on security. It's a good news, bad news scenario. The good news is law firms have awoken to the threat of cyber-attacks and the potential consequences and are responding with a commitment to security efforts.

Law Firms Are Most Susceptible to Common Security Risks

And now the bad news. Most law firms report that they are susceptible to common security risks and demonstrating table stakes security efforts. Approximately 60% of law firms struggle to manage both malware and non-malware born attacks, leading to significant IT or business impacts. What's worse, the same percentage of firms struggle to bear the growing cost of security efforts, manage and report the status of security risks and patching, and fail to demonstrate the value of IT spend to senior management. A further 58% report difficulties complying with clients or regulators or aligning to risk management requirements.

The Cycle of Despair

The research identified a cycle of despair across all industry segments tied to the gravitational struggle between the demands of the business and the desire to manage risks to the firm. The IT department is caught between the demands of the firm to remain competitive through the adoption of emerging technology, yet held accountable when that technology leads to a security event that causes a material change to the business. As in, the attorneys want new technology, and the partners don't want the associated risk.

Within the cycle, specific contributing factors were identified. Risk was increased by how aggressively firms adopted emerging technologies, such as cloud services, IoT, and AI. These risks were reduced by the overall security maturity posture of the firms, adoption of security technology and services, awareness and understanding of cyber risks at the executive level, and to some degrees, the reporting and spending structure of security efforts.

Law Firms Are Amongst the Least Cyber Mature

So, what constitutes cyber maturity is certainly the contentious issue, but less mature firms were those that reported using basic preventative technologies, such as firewall and anti-virus, and lacked integrated reporting, and threat response capabilities. Remember, these are self-reporting ratings of the respondents. Well above other industries, nearly 70% of law firms only employ preventative technologies, and worse, only 5% have deployed more proactive and predicted security measures to rapidly detect and contain attacks.

Only 27% of law firms deployed endpoint security compared to over double that figure for all other industries. Mobile, cloud, and logging lag around the same percentage.

The effect is compounded, because this rudimentary approach limits law firms' ability to deploy emerging technologies that carry greater risk. Across the board, businesses that reported a higher security maturity level were faster to adopt new technologies, such as mobile, cloud, IoT and AI. And let's be honest, calling many of these technologies “emerging” is like calling the Internet a “fad.” They are already here, burrowed into our digital DNA, and here to stay. For example, nearly 80% of firms have adopted some form of cloud services. They might not have grey hair, but they are not adolescent either.

Over the next three years, AI was consistently selected, across all industry verticals, as one of the top three technologies that will pose the most risk to enterprises. IoT was also selected, across five of the seven verticals included in our study as a leading security risk.

Whether It Be Money, Time or Heart, Spend Wisely

Perhaps it cliché, but the adage has merit. Invest your time and money wisely in ways that matter. You can't throw money at the problem, and certainly the majority of law firms I've worked with hold their purse strings closely. Spend wisely and focus on what matters. Applying a strategic approach to security means you improve your posture, which increases your ability to adapt to new technologies and deliver the services that your law firm needs to remain competitive.

*****

Mark Sangster is a cybersecurity evangelist who has spent significant time researching and speaking to peripheral factors influencing the way that legal firms integrate cybersecurity into their day-to-day operations. In addition to Mark's role as VP and industry security strategist with managed cybersecurity services provider eSentire, he also serves as a member of the LegalSec Council with the International Legal Technology Association (ILTA). A member of our Board of Editors, he can be reached at [email protected].