Law firms remain targets of cyber-criminals, largely due to the vast amounts of client data, information and money that they retain and the continued refusal of most law firms to take basic precautions when it comes to their cyber security posture.
By John Mc Loughlin, CEO of J2
They don’t always know their networks have been compromised and unfortunately the only time they realise a breach has taken place, significant damage may already have been done.
More concerning is that they don’t know what to do next, once they realise they have been attacked. It is evident that a large number of these attacks are swept under the carpet to protect reputations and in an effort to never accept blame.
The J2 Cyber Security Centre team has been involved in several investigations over the past weeks, with at least one new incident per day. There are ongoing attacks focused on conveyancing attorneys, commercial and criminal attorneys and the attacks are definitely not going to stop.
Bond originators are specifically being targeted and conveyancing attorneys continue to be a high value target in the criminal attack chain. This is largely because they are continually receiving and making payments on property transfers. However, it appears clear that this extends way beyond one field of law.
Attacks that span the entire value chain and it’s not clear why so little is being done. The victims include anyone from high profile celebrities to the average man on the street. Cybercriminals do not discriminate.
In every successful attack, there has been a weakness in the cyber security posture, poor cyber hygiene, lack of visibility and the absence of even the most basic controls in all parts of the legal supply chain. This includes the clients, bond originators and the attorney firms themselves.
Hundreds of thousands of rands are being lost each and every week and judging from the responses, there is no urgency to acknowledge the problem and have this stopped.
The cyber attackers are patient, they sit quietly in the systems and mail accounts of the attorney, bond originators or clients until the right piece of information hits. It is clear that once the cybercriminal gets a sniff of a new transaction, they work fast to spread their compromise as wide as possible. These highly inter-connected eco-systems across the field are then exploited for maximum gain.
If the affected firms do not take the simple steps to know where their weaknesses are and correct them, they can no longer act surprised when their clients have lost their hard earned money.
Cybercrime is real, cyber risk is real and the potential for a successful cyberattack is likely and highly probable. Executives, business owners or principals cannot be surprised when it happens, they cannot blame anyone but themselves if they haven’t secured their networks, their business and their clients. Ignorance is not an excuse.
Simple, practical and affordable solutions are available today, no matter the size of the practice. A manageable and fixed fee per end point or user is an easy way for legal firms to protect against these risks. Securing the gateways, gaining internal visibility and deploying a simple secure channel for communicating confidential information, is well within reach.
Cyber resilience is surprisingly easy to achieve, stop impersonations, secure sensitive communications and prevent inbound and web based attacks that goes hand in hand with a securely configured cloud email, data and backup solution. Please do not forget about creating awareness.
This is not about a product, it’s about adopting secure, modern business practices. One cannot continue to do things the same way it has always been done and expect different results in a changed world.
High profile attacks are reported, international celebrity’s data is leaked and the cyber criminals demand multimillion dollar ransoms. Locally, many firms choose to hide the breach, when possible, cover the losses and some end up shutting down.
Covering up a breach is far more expensive and even more complex than taking the steps to prevent it. It is difficult to comprehend why so many across the entire value chain simply choose to ignore this risk.
One needs to employ the services of a cybersecurity specialist to implement and manage a comprehensive managed cyber resilience solution for the entire practice. No matter which part of the connected supply chain one works in, it’s time to stop ignoring the threat and pretending it doesn’t exist.
If no action is taken immediately to protect one’s business, a cyber-attack is inevitable. It’s only a matter of time before a massive class action changes everybody’s attitude to cyber security basics and controls. Why wait?