Cybersecurity, Part 3 (Conclusion): Planning for an Attack
The prior articles in this series addressed the scope of the rising cyber security problem and some of the common mistakes that law firms make in addressing…
November 21, 2017 at 08:01 AM
6 minute read
The prior articles in this series addressed the scope of the rising cyber security problem and some of the common mistakes that law firms make in addressing the risks. This third and final article in the series answers two questions frequently asked by law firms: what specific steps can a law firm take to protect its data, and what can the firm do if its information is nevertheless accessed or stolen?
Effective cyber security policies vary among law firms based upon many variables, including size, location, scope of practice, and even national or global reputation. Although there is no one-size-fits-all solution for firms, one common approach includes the development of a cyber security plan. This typically is comprised of a Cyber Risk Management Plan and a Cyber Incident Response Plan. The former is intended to prevent cyber security problems, and the latter includes protocols and practices for addressing a cyber security breach should one occur.
An Ounce of Prevention is Worth a Pound of Cure
Everyone agrees that preventing fires is better than putting them out. In the cyber security context, this means taking steps to reduce the risk of a breach before it happens. Developing and implementing a Cyber Risk Management Plan helps reduce the likelihood of an incident occurring.
An effective risk management plan focuses not just on cyberspace. Many law firms will include terms in their plan to address physical security issues as well. This may mean taking steps to limit access to physical servers and other hardware so that only those who need to access them can.
This consideration extends to mobile devices, like smart phones and laptops. Such devices are easy to lose and can provide access to confidential information to anyone with the mobile device in hand. Thus, law firms may want to limit access to such devices so that they can only be accessed through a required password that is changed regularly. Some firms utilize remote-wiping, which allows the removal of all data and confidential information on a device that is lost or stolen.
There are other policies that work for some firms, but do not make sense for others. For example, some firms have adopted a policy banning the use of personal devices for work-related purposes. Others implement special procedures for the use of laptops or mobile devices by personnel travelling to areas the firm has identified as “high risk” zones, such as China or Russia. Still other firms require security scanning of storage devices, such as a thumb drive or a CD, before they are used on law firm systems.
Another important risk management tool relates to third-party vendors. A law firm is typically only as secure as its weakest vendor. Because law firms routinely use third-party vendors for litigation support, human resources, and other tasks, firms facing this issue may consider taking steps to ensure that those vendors agree to and comply with the firm's security requirements. Firms also may require vendors to notify them of a breach or assist with an investigation and resolution. As a safeguard, firms may attempt to include indemnify or hold harmless provisions in vendor agreements.
Develop and Implement a Cyber Incident Response Plan
Highly sophisticated hackers may successfully bypass security safeguards, despite a firm's best efforts to prevent a breach. In that situation, the firm is typically best prepared to address a breach if it has already developed and implemented a breach response plan. Even firms that invest significantly in preventing breaches are also well-served by preparing for the event of a breach.
Often, law firms believe that cyber incidents should simply be reported to the head of IT so that the IT team can handle the incident as it deems appropriate. However, a firm addressing a potential breach of confidential data may have obligations under the Rules of Professional Conduct; federal, state, or European Union regulations; common law; contract; or client engagement agreements. Incident response plans typically include several components.
First, the plan usually identifies the person within the law firm to whom a potential incident should first be reported. Most often, this individual is the general counsel, although a breach may be reported to another individual with authority to contact and engage outside counsel. The plan may also designate the chain of command for the incident response and identify who will make decisions on reporting obligations and next steps.
The plan may include notification and reporting policies for deciding whether to disclose the incident to affected firm employees, firm clients, and other individuals whose personal or confidential information was accessed, as well as to state and federal regulators. Identifying who needs to be notified and when they should be notified depends on several factors, including what data was accessed, who was affected, where the affected parties live, and what type of breach occurred. It may also necessitate the involvement of public relations or media specialists.
The plan also may contain information relating to the firm's computer networks and servers, including their physical locations and the types of information stored on them. Having this information readily available will facilitate immediate implementation of an internal investigation, which will in turn help determine the scope of the breach and appropriate remedial steps.
Finally, the plan may address whether to hire outside counsel to handle the internal investigation and provide advice. This is a common approach because outside counsel can provide credibility, cloak discussions in the attorney-client privilege, and assist in the event of a claim alleging a failure by the firm to adequately safeguard client data or appropriately respond to the cyber incident.
Cyber security is an important, ever-evolving issue that all firms need to consider and address. Having an effective cyber security plan in place can help to ensure that firms protect themselves, their employees, and their clients.
Shari L. Klevens is a partner at Dentons and serves on the firm's U.S. board of directors. She represents and advises lawyers and insurers on complex claims and is co-chairwoman of Dentons' global insurance sector team. Alanna Clair is a senior managing associate at Dentons and focuses on professional liability defense. Klevens and Clair are co-authors of “The Lawyer's Handbook: Ethics Compliance and Claim Avoidance.”
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllEnzo BioChem Settles With NJ, Other States for $4.5M Over Health Data Breach
4 minute read44 Class Actions: Lawsuits Are Flying Over a Data Breach. But Can They Succeed?
5 minute readTrending Stories
- 1We the People?
- 2New York-Based Skadden Team Joins White & Case Group in Mexico City for Citigroup Demerger
- 3No Two Wildfires Alike: Lawyers Take Different Legal Strategies in California
- 4Poop-Themed Dog Toy OK as Parody, but Still Tarnished Jack Daniel’s Brand, Court Says
- 5Meet the New President of NY's Association of Trial Court Jurists
Who Got The Work
J. Brugh Lower of Gibbons has entered an appearance for industrial equipment supplier Devco Corporation in a pending trademark infringement lawsuit. The suit, accusing the defendant of selling knock-off Graco products, was filed Dec. 18 in New Jersey District Court by Rivkin Radler on behalf of Graco Inc. and Graco Minnesota. The case, assigned to U.S. District Judge Zahid N. Quraishi, is 3:24-cv-11294, Graco Inc. et al v. Devco Corporation.
Who Got The Work
Rebecca Maller-Stein and Kent A. Yalowitz of Arnold & Porter Kaye Scholer have entered their appearances for Hanaco Venture Capital and its executives, Lior Prosor and David Frankel, in a pending securities lawsuit. The action, filed on Dec. 24 in New York Southern District Court by Zell, Aron & Co. on behalf of Goldeneye Advisors, accuses the defendants of negligently and fraudulently managing the plaintiff's $1 million investment. The case, assigned to U.S. District Judge Vernon S. Broderick, is 1:24-cv-09918, Goldeneye Advisors, LLC v. Hanaco Venture Capital, Ltd. et al.
Who Got The Work
Attorneys from A&O Shearman has stepped in as defense counsel for Toronto-Dominion Bank and other defendants in a pending securities class action. The suit, filed Dec. 11 in New York Southern District Court by Bleichmar Fonti & Auld, accuses the defendants of concealing the bank's 'pervasive' deficiencies in regards to its compliance with the Bank Secrecy Act and the quality of its anti-money laundering controls. The case, assigned to U.S. District Judge Arun Subramanian, is 1:24-cv-09445, Gonzalez v. The Toronto-Dominion Bank et al.
Who Got The Work
Crown Castle International, a Pennsylvania company providing shared communications infrastructure, has turned to Luke D. Wolf of Gordon Rees Scully Mansukhani to fend off a pending breach-of-contract lawsuit. The court action, filed Nov. 25 in Michigan Eastern District Court by Hooper Hathaway PC on behalf of The Town Residences LLC, accuses Crown Castle of failing to transfer approximately $30,000 in utility payments from T-Mobile in breach of a roof-top lease and assignment agreement. The case, assigned to U.S. District Judge Susan K. Declercq, is 2:24-cv-13131, The Town Residences LLC v. T-Mobile US, Inc. et al.
Who Got The Work
Wilfred P. Coronato and Daniel M. Schwartz of McCarter & English have stepped in as defense counsel to Electrolux Home Products Inc. in a pending product liability lawsuit. The court action, filed Nov. 26 in New York Eastern District Court by Poulos Lopiccolo PC and Nagel Rice LLP on behalf of David Stern, alleges that the defendant's refrigerators’ drawers and shelving repeatedly break and fall apart within months after purchase. The case, assigned to U.S. District Judge Joan M. Azrack, is 2:24-cv-08204, Stern v. Electrolux Home Products, Inc.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250