hacker data breach

 

The thought of a cyberattack strikes fear into the hearts of law firms every day. Yet rarely do partners take the necessary step back and ask: why are breaches having such an impact? The answer is simple—and so is the solution.

Breaches have a profound impact because firms are overly focused on securing their networks and data at the perimeter and not focused enough on what happens after an intruder gains a foothold. History shows that it is not a question of if but when an intruder will break through an organization's network defenses. This is what people mean when they say, “assume breach.” Security capabilities like multifactor authentication and firewalls help keep intruders out by securing the perimeter: closing off points of entry wherever possible. But intruders will break through—especially if they are a well-funded organization in a nation-state with hackers on salary.

Law firms can upend the landscape by making smart technological investments to secure their interior of their networks. Why is this so important?

Consider the infamous and public case of the Office of Personnel Management of the United States. One of the smallest agencies of the U.S. government, OPM serves as the “chief human resources” agency for the Federal government. In 2013, an advanced adversary broke past OPM's perimeter defenses, moved laterally throughout the network, and, because the hacker could dwell inside the network, the intruder found the crown jewel servers that held some of the nation's most sensitive data. The intruder stole the personally identifiable information of 21.5 million Americans.

The Need for Micro-Segmentation at Law Firms

A version of the OPM story plays out in almost every instance when an advanced intruder breaks into a cloud or data center that lacks internal security measures.

At its most basic level, micro-segmentation puts walls around databases and other vital applications and segments them away from the rest of the data environment. By micro-segmenting their networks, firms can establish an internal defense and prevent breaches from spreading. Within the suite of cybersecurity investments that an organization can make, it provides a deep foundation for cyberresilience.

Protecting the crown jewels 

Prioritization matters for any effective security strategy, but especially when it comes to protecting an organization's most important data. Every organization has crown jewels within its information technology and data infrastructure that are vital to the organization's overall mission. For law firms, it could be the data management system (DMS) that stores client data. The security of a firm's crown jewels can impact the well-being of entire organizations and countries and they require extra protection beyond perimeter defenses. So firms need to start by identifying their crown jewels and mapping them within the data center and cloud environment to discover application dependencies and vulnerabilities.

Micro-segmentation secures a firm's most important information by providing robust internal controls within a network, much like the doors of a submarine. If a breach happens in one part of the hull, the doors can lock and keep the breach from spreading and reaching the crown jewels. Since every internal firewall is also an alarm station, micro-segmentation can turn each server into a sensor that can detect attempts to violate policy. When a bad actor can only move between 3 application hosts vs. 3,000, their chances of accessing and stealing critical data without being detected is severely limited. Plus, the smaller attack surface makes it easier and faster for IT to find bad actors once they are in because they cannot move everywhere to hide.

Today multifactor authentication, encryption, and micro-segmentation are all parts of the “new” security stack that helps minimize the likelihood and impact of a breach. Micro-segmentation provides a baseline, a foil against vulnerabilities and a final defense against in the event that an attacker gets through. It can be installed on any enterprise within the preexisting network infrastructure and works for both on-premises servers, clouds, containers, and data centers.

Conclusion

The purpose of cybersecurity technology is to help humans manage their cybersecurity risks with greater ease and effectiveness.  Cyberspace is vulnerable. Attackers always find vulnerabilities in code and exploit human weaknesses. After a breach, to over-focus on specific perimeter vulnerabilities or instances of human error misses the larger strategic opportunity: no perimeter is perfect and even the best-trained teams cannot keep an intruder from moving throughout a cloud environment if the house has no alarms and all the doors have all been left open.

Micro-segmentation adopts an adversary-focused mindset and plans for breach. It takes just one foothold to gain immediate access to an insecure data center at a firm. When perimeter and user-focused defenses fail, as they will, firms require a robust internal defensive system to stop intruders and withstand attacks. A resilience-focused, defense in depth strategy will make the difference. Jonathan Reiber is Head of Cybersecurity Strategy at Illumio, a software company, and a Visiting Scholar at Berkeley's Center for Long-Term Cybersecurity. Former Chief Strategy Officer for Cyber Policy in the Office of the Secretary of Defense, Reiber is the author (with Arun Mohan Sukumar) of Asian Cybersecurity Futures: Opportunity and Risk in the Rising Digital World, published by Berkeley's Center for Long-Term Cybersecurity.