Here’s a somewhat reductive statement: There are only two kinds of companies—you’re either a law firm, or you do business with one. It’s broadly true. All but the smallest companies preserve some kind of a relationship with a lawyer or a law firm, and not just for reasons involving litigation. Lawyers help companies establish themselves, navigate state and federal regulations, create relationships with banks, arbitrate mergers and acquisitions, file their taxes, and yes, fend off the occasional lawsuit. Given that companies store so much information with law firms, what happens if they get hacked?
In SentinelOne’s new white paper, “The Scales of Justice Hold Weighty PII,” we explore the consequences that occur when a law firm is breached, as they relate to the companies they do business with and the firms themselves. They’re not happy stories—law firms can undergo millions of dollars in fines, lose their reputations, and go out of business. Their customers can have their private bank accounts exposed, undergo the loss of patents and blueprints, and worse.
Law Firm Security Personnel Should Have Seen This Coming
Even though the FBI has been warning law firms about cyberattacks since 2009, many law firms seem to almost roll out the welcome mat for attackers. Here here are some of the many flaws which were found during an inventory of Mossack Fonseca, the firm that leaked the Panama Papers:
“The login portal alone was subject to vulnerability known as DROWN, due to the fact that it allowed connections from servers that use an obsolete version of SSL. Attackers exploiting the DROWN vulnerability would have been able to hack Mossack Fonseca’s CMS in under a minute, using tools that cost less than $500. The CMS, by the way, had not been updated since 2013 at the time of the breach, and contained 25 additional vulnerabilities. Other failures included a webmail system that hadn’t been updated since 2009, a similarly vulnerable WordPress implementation, unencrypted emails, and other vulnerabilities which meant that the individuals who leaked the Panama Papers probably didn’t have a very difficult time getting their hands on sensitive information…”
These would be completely unacceptable defenses for a daycare, much less for a law firm that protected private information from several heads of state, including Vladimir Putin and David Cameron.
The Legal Industry Needs Robust Endpoint and Server Protection, Yesterday
Whether it’s fines, public disapproval, loss of businesses, or another impetus, law firm security personnel need to quickly recognize the need to upgrade their cybersecurity defenses. How can law firms go from zero to security when most of them don’t train employees on security awareness, don’t invest in modern infrastructure, and have tiny security budgets?
SentinelOne has an answer. With a lightweight, low-cost endpoint and server protection platform, we can rapidly bring any company up to speed on security. Our protection doesn’t just rely on recognizing known threats—we look for malicious behavior instead. We can see when malware attempts to encrypt files, exfiltrate data, or even exploit unpatched vulnerabilities. This gives administrators critical breathing room to bring out-of-date systems back into compliance.
If you’re a law firm, or you do business with one, you need to recognize that information security is crucial. Don’t believe us? Check out our white paper, “The Scales of Justice Hold Weighty PII,” and learn what your industry faces and what you can do about it now.
