"What firms are still getting to grips with is the preparation – what to do when it happens," says Bird & Bird's joint international commercial head Simon Shooter of the cyber attack that crippled DLA Piper's systems earlier this week.

"In the same way you have planned operation procedures for a fire in the office, you should have your 'speed dial response unit' [in the event of an attack], including PR consultants to deal with external and internal messaging," he adds.

With malware attacks now becoming more prevalent, experts argue that while law firms and companies clearly need to take all possible steps to avoid an attack, it is almost impossible to guarantee that they will never fall victim.

This reality means firms need to place as much emphasis on responding to an attack such as this week's incident – which also affected a host of companies including advertising giant WPP, pharma company Merck and the Ukrainian central bank – as they do on prevention.

Steve Hill, previously deputy director of the UK government's national security secretariat, now a visiting senior fellow at King's College London, explains: "You can minimise the risk of being vulnerable by doing basic cyber hygiene, but you can never 100% avoid this. It's a fact of digital life that these attacks can happen – it is about contingency planning and making sure you are prepared for the day when the attack does happen."

It only takes a little gap for the walls to be breached with potentially devastating consequences

Peter Church, a counsel in Linklaters' technology team, comments: "If you are looking at cyber security you need to think about technical, organisational and supply chain measures. In relation to each of them you need to make sure you are taking appropriate measures to protect yourself.

"However, it is incredibly difficult. If you think about the perimeter of organisations – the castle walls around them – it's a very long perimeter, and it only takes a little gap for the walls to be breached with potentially devastating consequences."

Of what all firms need to be thinking of in the wake of this latest attack, Kysen PR's Clare Rodway says: "The classic response is a disaster recovery plan. This basically means thinking of potential disasters before they happen and planning your response while everything is calm, and when you know that all the people you need to help you plan will be around to give their input. For smaller firms that have less sophisticated in-house support teams, this may not be as obvious to them."

So, assuming all preventative technology measures have already been taken, and that staff have been given the right training to minimise human vulnerability to attack, what does continuity planning for a large-scale intrusion look like?

Firstly, firms need to know the cyber security companies and agencies that will help them manage a crisis.

DLA Piper, which confirmed that it took down systems including phone and email as a precaution after its advance-warning system detected suspicious activity in its network, is working with external forensic experts and law enforcement agencies including the FBI and the UK's National Crime Agency to recover from the attack and establish its source.

Firms need to ensure they have tested how attacks would penetrate their systems and, as a result of this week's attack, which may have been caused by an update on third-party software, will also have to pay more attention to such software in future.

"There are reports that one source of the attack is an infected update from a software vendor," says Church, who adds: "It is difficult to protect against this type of attack. Some updates will go through a formal change process that might detect and stop the virus, but not all software updates will."

The technological aspects are only a small part of the challenges DLA will have been facing and others need to prepare themselves against.

The message a firm puts out internally and externally about the impact of the attack; how it is being dealt with and the potential impact for clients is every bit as crucial. A serious cyber attack is potentially as damaging to brand and reputation as systems.

"[Victims] need to involve their communications teams," says Hill. "Their CEO, their management, their GC and all of the stakeholders beyond the technology team – in order to make sure they manage potential reputational damage."

Jon McLeod, chairman, corporate, financial and public affairs UK at Weber Shandwick, says speed of communication is critical. "Don't sit on it – move as early as possible to communicate the issue."

However, Gus Sellitto, the co-founder of PR agency Byfield, warns that those affected should not feel too rushed into a response.

"You need to give as much reassurance as can be given, but DLA shouldn't panic into a response. It is important not to have an information vacuum, but also important to not give news until you know the scale of the situation. [People at the firm] need to get together and assess what that risk is, and then start communicating."

People are looking for a 'holy grail' technology that gives you safety from cyber attacks – that doesn't exist

"A chain of command then needs to be established – we need to see a face put to the name, with a managing partner coming out and making assurances about the IT security. They have international offices they need to coordinate, so they need to have a number of strong spokespeople."

But will even the best laid plans mitigate against the risk of longer-term reputational damage? DLA is about to find out, but at this point many in the market believe that with so many high profile attacks taking place, the firm is unlikely to suffer too much in the longer term.

Indeed, while some joke that DLA should have paid more attention to the nine-step cybersecurity guide it published in the wake of last month's WannaCry attack, others argue its position as a go-to adviser on cyber security may actually be enhanced by the crisis in the longer term.

"It is particularly ironic that it has happened to DLA, which is extremely highly regarded as a firm providing advice in dealing with cyber attacks," says McLeod. "I'm sure they will want to take their own advice on critical steps and they should know exactly how to deal with it, which should be of great comfort to the market. They will be able to speak from real experience – people know it is tough, and all of us operate on systems that are open to the world."

"The risk is that the media forgets that [DLA and the other companies affected] are the victims and portrays them as being negligent and at fault," adds Hill. "They need to make sure they have not been negligent so they can firmly rebuke that narrative. People need to understand that it is a fact of modern life that there will be cyber attacks."

"It is the dark side of moving to a digital commerce economy, and at the moment we are struggling to keep up with adversaries who are working with agility and at pace."

As Shooter concludes: "People are looking for a 'holy grail' technology that gives you safety from cyber attacks – that doesn't exist, and is unlikely to ever exist."

Pic credit: Above The Law