social media

Law firm technology operates over a core tension between cybersecurity safeguards and mobility needs. Firm attorneys are increasingly expected to be working and available outside of the office, but with the increasing onslaught of high-profile cyber breaches are also more concerned than ever about the need to protect data from hackers.

A new report from mobile security company Wandera found that one in six law firms don't have any enterprise mobility management platform in place; 75 percent of those that do use one of three platforms: MobileIron, AirWatch or a BlackBerry product. But even with a mobile management platform in place, the report notes, firm mobile devices may continue to be risk-prone.

Joel Windels, Wandera's vice president of marketing, said while mobile management platforms tend to control the functioning of a given device—what apps can be downloaded, what apps should be blocked, and what system tethering tends to be in place—they can often lack a sense of the data flow to and from that device.

“This report was focused a bit more on what's happening in the data, what's going on. It's a huge blind spot in a lot of the organizations,” he said.

Data flow to mobile devices has increased significantly in recent years. By Windels' estimation, over half of business web traffic is accessed via mobile device. The report additionally finds that the volume of data used per device has gone up nearly 84 percent annually.

Windels noted that given the added pressure on employees to stay available on their mobile devices, some of the lines around personal and business devices can get blurred for employees. While law firms spend a great deal of time trying to secure their office technology, some of those protocols and policies can go out the window once employees are out of the office. “As soon as someone leaves the office, there's no controls, [the firm has] no idea what's going on. Lawyers and partners are using them as if they're personal devices,” he said.

The report found that a typical 100-person law firm experiences around 14 attempts to access adult, gambling or “extreme” web content per day. Because of these sites' lax standards around personal data handling, malware or phishing links, accessing this content can put sensitive firm data held on mobile devices at serious risk of breach.

With the Global Data Protection Regulation set to take effect next May, Windels said many firms are now in that “panic stage,” with many scrambling to figure out how they can secure employee mobile devices from these threats and comply appropriately with the looming regulation.

“Now, law firms have a responsibility to be the first to know,” Windels said of the GDPR's application to data breaches. “Another part of the legislation is that if a breach does occur, it's on the IT team to show that they took reasonable measure to prevent it from happening,” he added, noting that having no plan of action with regards to mobile devices may leave companies exposed to the steep penalties that could be imposed under the regulation.

Windels acknowledged that mobile phones are not exactly the easiest to secure. Because many smartphones have roots in the consumer market, they create something of a conundrum for businesses to control and secure. One thing businesses can do, however, is put a platform in place to get a sense of what kind of data is flowing to and from mobile devices, which can theoretically help identify a potential problem before it gets too unwieldy. “You want a warning system that allows you to go investigate,” he said.