cybersecurity

 

This article appeared in Cybersecurity Law & Strategy, an ALM publication for privacy and security professionals, Chief Information Security Officers, Chief Information Officers, Chief Technology Officers, Corporate Counsel, Internet and Tech Practitioners, In-House Counsel. Visit the website to learn more.

 

Cloud service providers to the federal government must meet the rigorous requirements of the Federal Risk and Authorization Management Program. FedRAMP, as it's known, is designed to help federal agencies follow the government's “cloud first” policy, and includes detailed and strict encryption and other cybersecurity requirements.

This has become the gold standard in cloud security for the federal government with some of the highest standards of encryption, so it's tempting to think that you're covered by meeting FedRAMP requirements when performing e-discovery involving the government, or handling sensitive government documents.

You're not.

FedRAMP standards only cover the cloud, which is only one component in the e-discovery process. Firms need to pull back the lens and take a broader look at security and encryption throughout the entire workflow — from data collection at the very beginning of the e-discovery process through to disposition of data at the end.

FedRAMP Explained

FedRAMP was developed in collaboration with the National Institute of Standards and Technology, federal agencies and chief information officers in government and the private sector. Introduced in 2012, the standard stipulates that cloud vendors require multiple levels of security.

Regarding encryption specifically, the standard instructs vendors to encrypt:

  • Data partitions and swap partitions
  • File systems, including temporary ones, and files themselves
  • Storage devices
  • Log files
  • Databases
  • Virtual machine images that are not running

The standard ensures that federal data in the cloud is secure. However, the history of data breaches and security flaws has shown that cloud security is not necessarily the source of most breaches.

An incident last summer illustrates the weakest link in any security chain — the human being. An attorney at Wells Fargo accidently shared private information of more than 50,000 Wells Fargo clients with an outside lawyer. Wells Fargo said the information “was inadvertently released to a lawyer as the result of a subpoena.” Details on how the information was shared were scarce, but it appears it was not encrypted.

Encryption is still not widely used in the legal industry, including at law firms. A study of encryption trends by the Ponemon Institute found that, overall, the percentage of IT budget devoted to encryption has decreased over the last three years. In the industry category of “services,” which includes legal services, the use of encryption is on the rise, but still remains just half, 50%. (The “public sector” category is even lower, at 39%.)

To ensure a high level of security, general counsels and law firms must ask critical questions and encrypt data at each step in the e-discovery process.

Data collection (both physically and electronically). At the start of the e-discovery process, how are the parties sharing information? If data is being shared on a physical medium, make sure the hard drive or thumb drive is encrypted. If sent electronically, encrypt the data in transit.

Data processing (deduplication and filtering). This is usually done in a law firm's internal system. Is that network secure? What controls are there in terms of access? Are the attorneys able to dial in remotely to access the data and perform keyword searches to cull it down? Are they using a VPN or other secure tunnel?

Data transmission to the cloud service provider for review and document coding. Make sure the data is encrypted in transit or, if using “sneaker-net,” that the drive is encrypted. Remember that Eric Snowden walked out of NSA office in Oahu with a thumb drive.

Document review: Similar to above, how secure is remote or web based access? How do attorneys access the information? Are you making sure that the information stays in the cloud protected by the mandated security and is not downloaded to someone's computer? In 2015 an NSA contractor put classified material about how the U.S. defends against cyberattacks on his home computer, which was then hacked, allegedly by hackers for the Russian government.

Document production: What controls are in place when attorneys export the relevant documents? Is the data encrypted in transit?

Post-discovery: After a matter ends, who is responsible for securely disposing of the data? Whether it's a service provider, law firm or another entity, the most secure technique is the Department of Defense wiping standard 5220.22-M, which overwrites the data three times with computer-generated random characters so it cannot be recovered by any commercially available process.

Conclusion

Today, the cloud has earned the confidence of federal government agencies, including those that store top-secret information. A top technologist at the CIA recently remarked that the cloud is better equipped than legacy systems to house the country's most sensitive data. “The cloud on its weakest day is more secure than a client service solution,” said Sean Roche, associate deputy director at the CIA's Digital Innovation Directorate. “Encryption runs seamlessly on multiple levels. It's been nothing short of transformational.”

By reviewing the various phases in the e-discovery workflow for security and encryption, you'll ensure that the data is protected before and after the cloud as well

 

David A. Greetham is vice president of e-Discovery, Ricoh Americas Corporation.