Cyber-incidents have become an immutable fact of life for many industries, but they can be particularly harmful to e-discovery companies and their networks of "very expansive systems."  It's a notion that Epiq Global unwittingly reinforced last week after the e-discovery and managed services company was hit with an attack involving the "Ryuk" ransomware protocol. According to the Center for Internet Security, Ryuk is a crypto-ransomware that "uses encryption to block access to a system, device or file" until a ransom is paid.

While it's not a style of attack unique to the e-discovery space, other vendors in the industry could still find themselves reevaluating their own security postures to avoid the same system disruptions that continue to plague Epiq's Restructuring and Bankruptcy, Class Action and Mass Tort and Legal Solutions businesses.

Some of that work may have begun long before the Epiq news broke. Neil Etheridge, chief marketing officer at DISCO, indicated that investments in data security have generally varied greatly between e-discovery companies, but high-profile data breaches have pushed the subject of cyber defenses to the forefront of the legal industry.

"Vendors recognize that cybersecurity is a massive undertaking for law firms and that they need to be a trusted partner, especially as law firms increasingly demand transparency and details around security and privacy practices and protocols," Etheridge said.

When those protocols do fail, the aftermath can be costly for law firms or other clients. For example, a statement released by Epiq on Saturday said an ongoing investigation had revealed no evidence that any client data had been "accessed, misused, or extracted," but that the company is still unsure how long it will take to bring the impacted systems back online securely.

Etheridge anticipates that a post-Epiq world will definitely feature increased security demands and requirements from clients, which in turn could drive native-cloud providers to reevaluate the choices they've made with regards to web services. Some may even turn to outside help.

"E-discovery providers recognize that trying to build a data center from the ground up is not sufficient from a security perspective. They are now prioritizing data security and going above and beyond industry-standard certifications by leveraging [cloud] providers," he said.

That may not be the only decision point that e-discovery vendors find themselves revisiting. Mary Mack, CEO and chief legal technologist at EDRM, pointed out that most e-discovery providers are concerned about uptime, or the percentage of time a machine has been working or available. However, uptime is not always in sync with cyber hygiene. For instance, backups kept in nearline storage are not segmented from the general data, meaning that a restore can be performed rather quickly in the event of an incident.

But while segmentation may not do efficiency many favors, it can be a big plus for cybersecurity. "With ransomware, you really need an off-site [storage], you need something that's separate. You need a physical separation, not just a software logical separation," Mack said.

The issue of segmentation may also impact the way an e-discovery provider designs its database architecture. A multitenant approach, for example, uses the same instance or database and then separates individual cases or clients using software. "It makes the possibility of contagion more because your segmentation doesn't work well," Mack said.

Instead, some e-discovery providers such as Exterro and Hanzo have opted for a single-tenant architecture, which stores clients across separate databases. Brad Harris, vice president of product at Hanzo, indicated that his company made this decision at least partly for security.

"If the infection comes or the virus comes into that environment, you're only effecting that one customer's set. … But that in and of itself does not protect you just because you've got all of the different tenants out there," Harris said.

For example, if a piece of ransomware were to spread from employee computer to employee computer, it could still potentially find its way into various segmented databases. This is where the human factor ultimately becomes as important as technology, and Mack thinks it's possible that more e-discovery companies will begin running incident response drills to help cut down on costly mistakes that help malware spread.

Shashi Angadi, chief technology officer at Exterro, also foresees e-discovery companies bringing in more personnel devoted to data security. "I think that there's a lot more focus on prevention. The cure is after the fact," he said.