Cyber Security 101 for Legal Professionals

Learn more about Clio`s cutting-edge security. In today`s business environment, the likelihood of a cyberattack is relatively high. Being ready, reacting and recovering is paramount. Guidelines for this feature should include: Kenya is locked up in the District of Columbia, holds the NARA Certificate of Federal Records Management, and is CEDS certified. Kenya writes and lectures frequently on the topics of information governance, cybersecurity and eDiscovery. She is a board member of ACEDS, Cybersecurity Law & Strategy, ACC`s Data Steward Program Working Group and Women, Influence & Power in Law. The Secure Sockets Layer (SSL) Internet Protocol is the security protocol that allows users to do simple things, such as buying items online safely. Netscape released SSL 1.0 in 1994. After improvements, SSL became the core of the language for the secure use of the web, known as hypertext transfer protocol (HTTP). Knowing that security experts are much better at mapping, adversaries adapt. It is becoming increasingly common for hackers and nation-state cybercriminals to try to imitate each other in order to thwart attribution efforts. They also learn from each other to improve their skills.

But first and foremost, their goals remain different. Cybercriminals are generally more interested in money, while nation-state hackers are interested in stealing intellectual property and causing disruption. To understand the vast world of cybersecurity or any other technical field, the learner must master the words and phrases that are unique to this field. These terms and expressions often have a related, but not entirely accurate, meaning in general non-technical usage. Without a clear understanding of how security professionals use certain words and phrases, learning this specialty can be very confusing. For more information and WSBA support on document retention, consider these resources available to WSBA Licensed Lawyers: Cybersecurity systems and processes based on deception are the best examples of active defense. A jar of honey is the most basic security based on deception. In more sophisticated schemes, security experts place decoy data and apparently points of attack on all their systems. Affected companies must notify data subjects within 45 days of discovery of the breach. The notice must be in writing (by mail or email) and must include at least the following: (1) the date; (2) a description of the data breached; (3) measures to restore security and confidentiality; (4) the measures that the person may take to protect himself or herself against identity theft; and (5) Contact Information. If the violation affects more than 1,000 people, additional notifications are required within 45 days, including the Alabama state attorney general and consumer reporting authorities.

Don`t assume that everyone knows how to recognize and avoid a phishing email – open a dialogue and continue to train employees to avoid accidental user mistakes and promote best practices for law firm data security. Require that training be completed at the time of rental and regularly thereafter (usually once a year). Maybe you`ll never get a panicked call from a customer about a cyberattack in real time. If you do, we hope that your customer has already completed an assessment and taken reasonable precautions to protect their data. Gone are the days when customers could turn a blind eye to cyber threats. Today, expectations have changed. We need to help our customers take reasonable precautions to protect data and inform data subjects in a timely manner. Despite these risks, law firms are required to protect their clients` information.

When criminals invade your company`s security, the consequences can be far-reaching – from minor embarrassments to serious legal issues, including: in-house lawyers and paralegals handle some of the company`s most sensitive and confidential information and are therefore prime targets for cybercriminals. Areas of risk to consider, according to the Law Society of Scotland, include computers and computer systems; Your employees and contractors; personal phones and mobile devices; cloud portals and platforms; remote and home-based work; transmission and storage of data; and the company`s public website. EDR: Endpoint Detection and Response is a type of security tool that focuses on detecting and mitigating suspicious activity on devices and hosts. The value of EDR is the ability to detect advanced threats that may not have a registered behavior pattern or malware signature.