In the year of 2021, one of the primary concerns for the legal profession has been cybersecurity threats. These firms must understand the top cyber threats they are facing in order to manage the risk and preserve operational resiliency. Who is attacking them, how are they being attacked, and how can these firms protect themselves against these attacks?

Law firms are functioning in a digital environment that is becoming increasingly unfriendly. Cyber security has overtaken COVID-19 as the second most significant concern facing law firms, and it’s easy to see why: law firms are an attractive target for hackers looking to steal substantial sums of money and sensitive client data. Why put the effort in to hack a single business when you can hack a law firm and gain access to a portfolio of their clients.

With many lawyers working remotely in response to the ongoing coronavirus pandemic, cyber risks will continue to be a problem – since lockdown was implemented, 20% of organisations have experienced a breach owing to the acts of a remote worker.  

For law firms, the danger of a cyber-attack and data breach has never been higher, and the potential ramifications have never been greater. The cyber threat to law firms must be evaluated in the context of the reputational harm that a data breach could create in an industry where trust is essential. The first step in reducing the dangers posed by threat actors is to understand who is assaulting law firms and why. In this article we will take a look at some of the recent threats that law firms must keep an eye out for.

1. Ransomware

Ransomware has been one of the most common cyber-attack strategies used by cybercriminals to target legal firms in 2021. In a typical ransomware attack, hackers gain access to a target organisation’s network by sending a phishing email (a false email sent by cybercriminals that looks like it came from a trustworthy source) as well as smishing attempts (Smishing is a phishing cybersecurity attack carried out over mobile text messaging.) 

The malware infiltrates the network, and the attackers conduct reconnaissance and other activities in order to gain the necessary access to run the ransomware. Once this is completed, the target organisation’s network is encrypted and effectively rendered inoperable until a ransom is paid or the network is restored using backups.

From late-2019 onwards, double-extortion became a popular practice as a new way to make money. The attackers threaten to disclose stolen data onto the internet in a double-extortion ransomware attack. The goal of double-extortion ransomware operations is to embarrass target organisations into paying a ransom, even if they have adequate backups in place to protect themselves against a typical ransomware assault.

2. Insider Threats

Most law firms understand the importance of safeguarding themselves from cyber security and data breach threats from the outside world. This means that most businesses will have firewalls, email encryption, and other security measures in place. However, there is a worrying new trend that is considerably more difficult to detect: the insider danger.

Insiders are responsible for roughly 75% of cyber mishaps. These are usually classified into one of three groups: 

• Careless insiders can be one of the most typical forms of a business threat.
• These employees are a security concern because they use weak passwords or leave equipment unprotected, 
• Exploited insiders are frequently well-intentioned and completely innocent personnel who are duped or manipulated into disclosing information they should not; and 

malicious insiders are far less prevalent, yet their desire to harm others amplifies the amount of damage they may cause. 

Insider breach risk was cited as a major worry by 96% of IT leaders in the legal sector in March 2020.  Employees sharing data to personal systems, leaking data to competitors, leaking data to cybercriminals, or carrying data to a new job are all examples of data breaches.

It’s challenging to strike a balance between safeguarding your company’s assets and making your employees feel valued and trusted. It’s also a good idea to encourage your employees to feel empowered and confident enough to disclose any cyber dangers.

3. Communicating via consumer apps 

Mobile communications present major privacy challenges for the legal industry and a single security breach could result in irreparable reputational damage. Client-attorney privileged discussions, confidential merger/acquisition details, and integral legal strategies are just a few examples of mobile communications that have been intercepted and used to the perpetrator’s advantage.  

Confidentiality is, without a doubt, a crucial prerequisite for all lawyers. However, unintended disclosure of confidential and/or privileged information to third parties can readily occur when using consumer messaging apps. When a messaging app is installed, it may ask for access to the phone’s contact list so that it can import the complete list directly onto the consumer messaging app’s servers.

As a result, a lawyer who uses the app may have unwittingly disclosed his or her clients’ confidential information with third parties, which is obviously problematic. The use of consumer messaging systems also ensures that messages and advice provided via these platforms are not only insecure but also non-compliant.

4. Sophisticated human persuasion & manipulation through Social Engineering

Social engineers take use of the one flaw that every organisation has: human psychology. These attackers use phone calls and other forms of communication to dupe people into handing them access to the organisation’s sensitive data. The term “social engineering” refers to a wide range of malicious activity such as pretexting, baiting and quid pro quo. 

Pretexting is a type of social engineering in which attackers focus on establishing a convincing pretext, or invented scenario, to obtain personal information from their victims. In these types of scams, the fraudster frequently claims that they require specific pieces of information from their victim in order to verify their identity. They then steal that information and use it to commit identity theft or launch secondary assaults. Advanced attacks may try to persuade their targets to do something that exploits a company’s digital and/or physical vulnerabilities.

Baiting is comparable to phishing assaults in many respects. The promise of an object or a good that bad actors employ to attract victims sets them apart from other sorts of social engineering. Baiters may utilise enticements such as free music or movie downloads to get consumers to hand over their login information. 

Quid pro quo attacks, similar to baiting, promise a benefit in exchange for information. Baiting normally takes the form of a good, whereas this benefit usually takes the form of a service.

How do I protect my law firm and clients?

Cybercriminals are aggressively targeting global law firms with phishing emails, smishing attacks, social engineering attacks, insider threats, spyware and double-extortion ransomware assaults, and will continue to do so as long as these attack methods are effective (and profitable). So in order to defend your law firm, you must first comprehend the dangers you face. You can take actions to mitigate these hazards by understanding them.

When a cybersecurity breach occurs, one of the first issues that arises is how much it will cost the company. Of course, this is not to be treated lightly, but due to the nature of law firms’ job, reputational damage must also be regarded seriously. Major legal companies handle a lot of sensitive information and are trusted by their clients to keep it safe and secure. The legal profession is established on the foundation of this relationship.

A cyber-attack that results in a data leak could severely damage a firm’s hard-earned image in the legal industry. Something from which it may be difficult to recover from. Despite the fact that many people are now aware of the importance of cyber security, many still don’t have a good knowledge of what precautions to take to limit risks (and those who are still ignorant to the threats).

How Salt Communications can prevent threats to law firms

Salt is a secure communications solution that provides the best armour available to protect and

secure information when communicating on mobile and desktop devices. As a proven safe haven network it provides the highest security available for both law firms and their clients. 

Mobile communications present major privacy challenges for the legal industry. Client-attorney

privileged discussions, confidential merger/acquisition details, and integral legal strategies are just a few examples of mobile communications that have been intercepted and used to the perpetrator’s advantage. A single security breach could result in irreparable reputational damage.

The trend away from traditional face to face meetings with clients towards real-time messaging

applications like WhatsApp and Zoom, risks highly sensitive information being shared on less secure open platforms. There are many media reports of security breaches on consumer-oriented platforms such as the recent Pegasus based attacks suffered by organisations across the globe.

If you fear a hack by malign actors who may be motivated by political, economic, personal, or ethical reasons, then it is essential to protect the internal and external communications of the firm from attack and exploitation – which is what Salt offers to law firms globally.

Salt has been developed in collaboration with global law firms to create a best-in-class feature set for the legal sector:

• Salt has the capability to safely segregate teams within a law firm and securely maintain ethical walls.

• Salt can seamlessly integrate with your Document Management System enabling the secure storage and retrieval of confidential documents or can operate stand-alone

• Salt can be used for effective and secure client matter management with group chat, conference calling and document sharing capabilities. 

Using Salt secure communications demonstrates that ensuring client confidentiality is of fundamental importance to your firm and your client’s dedicated lawyer. 

To discuss this article in greater detail with the team, or to sign up for a free trial of Salt Communications contact us on info@saltcommunications.com or visit our website at https://saltcommunications.com/legal/. 

About Salt Communications 

Salt Communications is a multi-award winning cyber security company providing a fully enterprise-managed software solution giving absolute privacy in mobile communications. It is easy to deploy and uses multi-layered encryption techniques to meet the highest of security standards. Salt Communications offers ‘Peace of Mind’ for Organisations who value their privacy, by giving them complete control and secure communications, to protect their trusted relationships and stay safe. Salt Communications is headquartered in Belfast, N. Ireland, for more information visit Salt Communications.