In 2008, the government cybersecurity community expressed concern that U.S. critical infrastructure represented the nation's soft underbelly. There was further unease with respect to law firms and other professional service firms, which have access to the sensitive business and other information of their clients. While government and the private sector spent cycles assessing and planning to manage cyber risks among the then-18 critical infrastructure sectors, professional services generally were not part of the dialogue. Although a series of subsequent public and private sector high-profile cyber incidents suggest that critical infrastructure and professional services firms are no softer than much of government, there clearly remains a national aggregate risk that is comprised, in part, by the cyber risk introduced from professional services including law firms.

As a corporate transactional associate from 2000 to 2006, this risk was not top of mind. One constant consideration, however, revolved around transactional specialization—securities offerings, mergers and acquisitions, general corporate advising. An interesting dynamic that is seemingly irrelevant, but actually presents a fantastic departure point for discussing law firm cyber risk, was the quest among corporate associates to find identity in popular culture. Whereas the mergers and acquisitions community had Bryan Burrough and John Helyar's Barbarians at the Gate as a guide point, and securities enforcement attorneys had James B. Stewart's Den of Thieves, budding securities transactional lawyers were left searching. Then, a colleague stumbled upon Arthur R. G. Solmssen's The Comfort Letter, which focused on critical aspects of a securities transaction. Although published in 1975, it largely captured the life of an offering 25 years later (other than the in-person versus EDGAR filings with the SEC).

A central item of the story, which remains so, is the “comfort letter” itself. Independent auditors are asked to issue a letter “in accordance with AU-C section 920 to requesting parties in connection with an entity's financial statements included in a securities offering.” AICPA, “Concerns Regarding Comfort Letters/Third Party Verification.” Delivered at pricing, with an update or “bring down” letter delivered a few days later as a closing condition, the letter provides underwriters with comfort around the issuer's previously issued financial statements based on additional information reviewed by the independent auditor. A common experience with the “bring down” letter was that it would be delivered at the last minute as a signed document scanned into a PDF format amid the series of final movements required to orchestrate the closing. Counsel for the underwriters, usually a somewhat junior attorney, would quickly open the PDF, confirm no unexpected caveats and update the closing files and checklist. Sometimes the reviewer is operating on little sleep due to the closing transaction or other, parallel transactions. A good practice is to maintain contact with the independent auditor so that all parties share the same expectation for when the “bring down” letter will be delivered. Successful transaction management requires controlling the controllable. In doing so, attorneys can dedicate resources to surprises that inevitably surface over the course of the transaction.

This common scenario offers a small window into the life of a securities lawyer. It also is instructive as a common activity that could be exploited by a malicious actor. Spearphising emails with malicious attachments continue to serve as a primary threat vector for gaining initial access to a victim's network. A weaponized PDF, Microsoft Office file or other seemingly innocuous attachment can serve as first-stage malware that, when opened, undertakes a series of communications with a command-and-control server to download second-stage malware as either a file or as so-called “file-less”, persistent, memory-resident code. The initial emailed file might exhibit any number of appearances. It could be a file with no text, but attached to an email with the subject line “Comfort Letter.” The file itself might use that as the filename, but contain no text. It also could include text that makes it appear to be an actual comfort letter. The sender may spoof an address at the independent auditor, although an unsuspecting attorney might open the attachment without paying close attention to the sender's address if the attachment appears to be related to an expected closing delivery.

Ultimately, the threat actor is probably not even targeting the deal for which the comfort letter is anticipated. This scenario could be the precursor to moving laterally within a law firm and establishing persistence around an unrelated target, such as pending patent prosecutions for a different client, material litigation for an unrelated client or other pending market-moving information for a public company. Additionally, the foothold obtained at the firm could be used to send spearphishing emails from legitimate email accounts to clients of the firm. The trust relationship inherent between attorneys and their clients increases the likelihood of a client opening an attachment or clicking on an embedded link, subsequently leading to a compromise at the client.

None of this is to suggest doom, gloom or a need for panic. Instead, law firms simply need to recognize that their operations entail a variety of risks, including cyber risks. The electronic document-heavy world of attorneys dictates that cyber risk management strategies should account for a variety of electronic file types generated by, sent from, received by and stored by firm employees and contractors. As with most organizations, a law firm will likely agree that the security of its networks and data is important. The care owed to client information should enhance that agreement. In general, the principal cyber risk management challenge faced by public and private sector organizations is not technical, nor is it related to a lack of cybersecurity personnel. These certainly present challenges, but the primary challenge is one of governance—how is risk management, and associated security mitigation and risk transfer decisions, woven into the fabric of a private sector business or government agency such that it supports business or mission operations. Risk management strategies that cascade from and support business strategies are likely to receive acceptance and execution from across an organization. This enables chief risk and information security officers to better perform their roles through management attention, right-sized budgets, enterprise employee training and awareness and enforcement of security policies.

As law firms consider their approaches to risk management and associated security policies, a set of external and internal resources are available. The Legal Services Information Sharing and Analysis Organization provides its members with, among other things, trusted best practices around risk management. This includes approaches taken by organizations in other sectors, such as financial services, energy, retail and government. Often, the challenge for risk and security professionals is to obtain the necessary support from within their organizations. Members of information sharing and analysis organizations can discuss successful ways to garner such support. For a larger law firm, another resource is its data privacy and cybersecurity practice, if it has one. The attorneys within that practice advise clients with respect to their own cybersecurity and risk management. Law firm information security officers often find a receptive audience within these practice groups who can serve as bridges to attorneys in other practice areas.

While smaller firms may not have a dedicated information security staff, or at least a large one, their resourcing decisions and sensitivity to expenses will benefit from a commitment to cyber risk management as a part of general risk management, which in turn should be a standard component of law firm management. Of course, technology considerations remain important. The “comfort letter” scenario suggests some of them. Business relationships that entail sending and receiving a variety of documents at regular and irregular intervals have led to the emergence of a “soft” supply chain. Instead of embedding malicious code into hardware and software, it can enter an enterprise through everyday business documents, such as memoranda, newsletters, bills of lading, invoices, spreadsheets and slide presentations. To the extent practicable, understanding who is transmitting and receiving a file, what the file is and how the file is stored are important aspects of security.

DMARC is available to increase confidence that an email is in fact coming from its purported source. Many organizations employ application white-listing to ensure that only approved software runs on their networks. However, those approved applications remain free to execute files that are malicious. Technology that provides deep file inspection, remediation and sanitization can ensure that all executed files structurally adhere to the file-types' specifications and adhere to enterprise policies focused on the use of macros and other scripts, metadata, embedded files and other functional attributes. Encryption schema and data loss prevention tools are available to reduce risks associated with files at rest and in transit.

The application of these various solutions should be tightly coupled to an organization's risk management strategy, which is similarly united with business or mission strategy. For example, some business units may require the ability to use macro-enabled documents, and the risk management strategy should drive security policies that support those users while eliminating the potential threat vector for other business units. Technology investments can then be applied to support those security policies.

No matter how a law firm devises and implements its cyber risk management strategy, it is essential that two goals are achieved: supporting the law firm's business activities and securing client information. In a complex environment of multiple clients, multiple matters and teams of attorneys and other staff, cyber threat actors will exploit the dynamic daily firm cadence. Attorneys, security professionals and risk management teams cannot anticipate everything. They can control the controllable, thereby freeing up energy, cycles and resources to handle the unexpected. Proactive risk management provides that control.

Matt Shabat, former securities attorney at Mayer Brown and former Department of Homeland Security cybersecurity official, is currently US Strategy Officer at Glasswall Solutions.