An Inside Look at How Cooley, Davies Manage Cybersecurity

Law firms arouse much concern when it comes to their security apparatuses, often seen as a significant vulnerability for valuable corporate data. And while law firms have at times gotten a bad rap for meeting this particular client need, efforts are increasingly underway to shore up security.

Or, as Davies Ward Phillips & Vineberg director of information technology Ivaylo Nikolov put it, everything law firms do “is to meet the clients' requirements. I don't think security is anything different. Security is just a tag-on that, in the last five to ten years, has become of a big deal. … It's really an old discussion, just the next step in the process.”

Nikolov joined a long list of law firm security professionals at ALM's LegalWeek Strategic Technology Forum USA event last week in San Diego. He was among the panelists in the session “The Value of Defense in Depth as Data Security Theory,” discussing pressing security threats and how law firms were trying to address them.

Peter Bruzzese, strategic technical consultant at cloud email security and archiving company Mimecast, has seen many fall victim to the sorts of security threats facing law firms. “Typically, these attacks are coming through email,” he said, noting that a report in Wired said 91 to 96 percent of attacks occur this way.

Therefore, he said, one must ask who the attackers are coming for. To explain those frequently targeted, he used home burglary as an analogy, asking: Who would you rob? The house with or without the gate?

“When we talk about defense in depth, we're talking about multiple layers of security,” he said. And the “weakest” link in the apparatus is the end users, some of which are malicious, and others careless. “No matter how much training you give them, they're going to click the link.”

Mike Santos, director of security and information governance at Cooley, said that people need to think about security beyond technology and consider whether they're taking steps to comply with regulations and security frameworks, as well as whether employees are following security policies.

A lot of organizations, Santos said, “may have a lot of products” but don't use most of them. What's more, many products and updates on their users' systems simply aren't activated, and simply turning them on can help avoid spending on training and finding new vendors.

“It's not just, 'Hey, I have these technologies and they overlap each other.' … The WannaCry patch was out two months [before the attack],” he said. Santos added that if you ask, “everyone will say they patched. But how many know it went out to all of their machines?”

“It's one thing to say you patched, but there's all these other pieces.”

“We don't look at security for the sake of security,” Nikolov said. Instead, his firm looks at security as “if we get breached, what is it they're going to go after.”

Nikolov advised a room full of CIOs to establish risks for your clients' data, how much damage can be tolerated, and “then you can work backwards”—find what tools you need and how to layer them.

But, he added, people “are the weakest link. We approach [security] from that angle most of the time because everything else is in place.”

Users often fall victim to malicious links embedded in communications like emails, a process known as phishing. The speakers both said they used email filtering to prevent employees from receiving malicious emails, with Santos preferring ProofPoint and Nikolov using Mimecast, and relying on sandboxing—isolating a program or file for testing—for documents like PDFs.

“People don't do things because they're stupid, they do things because they don't know,” Nikolov added.

Santos said that when looking at “hosted services” like Google Drive and Microsoft Office 365, “What you have to start to look at is, 'When I go there, what security do they offer?” Microsoft is “going to tell you they're secure” and that it has advanced threat protection, but will you get what the law firm actually needs?

He also advised to consider whether you're “putting all your eggs in one basket” and look at a multitude of products. “If you're going to defend a country, you don't just have an army.”

Law firms arouse much concern when it comes to their security apparatuses, often seen as a significant vulnerability for valuable corporate data. And while law firms have at times gotten a bad rap for meeting this particular client need, efforts are increasingly underway to shore up security.

Or, as Davies Ward Phillips & Vineberg director of information technology Ivaylo Nikolov put it, everything law firms do “is to meet the clients' requirements. I don't think security is anything different. Security is just a tag-on that, in the last five to ten years, has become of a big deal. … It's really an old discussion, just the next step in the process.”

Nikolov joined a long list of law firm security professionals at ALM's LegalWeek Strategic Technology Forum USA event last week in San Diego. He was among the panelists in the session “The Value of Defense in Depth as Data Security Theory,” discussing pressing security threats and how law firms were trying to address them.

Peter Bruzzese, strategic technical consultant at cloud email security and archiving company Mimecast, has seen many fall victim to the sorts of security threats facing law firms. “Typically, these attacks are coming through email,” he said, noting that a report in Wired said 91 to 96 percent of attacks occur this way.

Therefore, he said, one must ask who the attackers are coming for. To explain those frequently targeted, he used home burglary as an analogy, asking: Who would you rob? The house with or without the gate?

“When we talk about defense in depth, we're talking about multiple layers of security,” he said. And the “weakest” link in the apparatus is the end users, some of which are malicious, and others careless. “No matter how much training you give them, they're going to click the link.”

Mike Santos, director of security and information governance at Cooley, said that people need to think about security beyond technology and consider whether they're taking steps to comply with regulations and security frameworks, as well as whether employees are following security policies.

A lot of organizations, Santos said, “may have a lot of products” but don't use most of them. What's more, many products and updates on their users' systems simply aren't activated, and simply turning them on can help avoid spending on training and finding new vendors.

“It's not just, 'Hey, I have these technologies and they overlap each other.' … The WannaCry patch was out two months [before the attack],” he said. Santos added that if you ask, “everyone will say they patched. But how many know it went out to all of their machines?”

“It's one thing to say you patched, but there's all these other pieces.”

“We don't look at security for the sake of security,” Nikolov said. Instead, his firm looks at security as “if we get breached, what is it they're going to go after.”

Nikolov advised a room full of CIOs to establish risks for your clients' data, how much damage can be tolerated, and “then you can work backwards”—find what tools you need and how to layer them.

But, he added, people “are the weakest link. We approach [security] from that angle most of the time because everything else is in place.”

Users often fall victim to malicious links embedded in communications like emails, a process known as phishing. The speakers both said they used email filtering to prevent employees from receiving malicious emails, with Santos preferring ProofPoint and Nikolov using Mimecast, and relying on sandboxing—isolating a program or file for testing—for documents like PDFs.

“People don't do things because they're stupid, they do things because they don't know,” Nikolov added.

Santos said that when looking at “hosted services” like Google Drive and Microsoft Office 365, “What you have to start to look at is, 'When I go there, what security do they offer?” Microsoft is “going to tell you they're secure” and that it has advanced threat protection, but will you get what the law firm actually needs?

He also advised to consider whether you're “putting all your eggs in one basket” and look at a multitude of products. “If you're going to defend a country, you don't just have an army.”