Beyond the Fortress Fortify Your Content Before it Travels Beyond the Firm Walls.
Post on 03-Jan-2016
215 Views
Preview:
Transcript
Beyond the Fortress
Fortify Your Content Before it Travels Beyond the Firm Walls
• Paul Domnick, Board of Directors, Litéra Corporation
• Michael Fick, Consultant, Enlitened Technologies
• Joy Heath Rush, Vice President, Client Development (Law Firms), Litéra Corporation
Our Panel
Clients demand
protection of material under law
firm control
Lawyers have a duty to protect client data
Law Firms are
perceived as easy
targets for bad guys
Firms share sensitive
information across
security boundaries
Framing the Issue
Law Firms as Cyber Targets
• Aggregate highly confidential information
• Most firms’ DM security is public by default
• Organized into client/matter folder structures
• Contain data from multiple organizations pertaining to one transaction/matter
• Perceived as less secure
• ABA Model Rule 1.6 - Confidentiality of Information. Require lawyers to keep confidential ANY information relating to the representation of a client.
• ABA Model Rule 1.1 Comment 8 - Competency. To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology
Ethical Responsibilities
• Lawyers are communicators• Lawyers access the most confidential information• Lawyers work as part of a team – need to collaborate• Lawyers work everywhere – sometimes in unsecured
environments• Lawyers are under severe client pressure• Lawyers communicate with third parties creating
content in motion• Lawyers’ duty to protect and manage client information
extends beyond the firm’s firewall
Why Does the Practice of Law Create Business Situations that Could
Compromise the Confidentiality of Client Information?
What are Firms Doing to Protect their Client Information and Electronic Communications?
Source: A Study of the Legal Industry’s Information Security Assessment Practices, Sponsored by ILTA’s LegalSEC Team, August, 2013
• General security of the firm’s IT• Security of their data• At rest/in motion
• Comingling • Auditable defense • Adherence to regulatory requirements
Client Audits – Spotlighting Concerns
“If you don’t understand what your clients expect of you, then you cannot invest in the appropriate level of protection and make informed decisions about risk.”Law Technology News – April 7, 2014
What Clients Expect Law Firms To Do
Protecting the infrastructure and the edge is critical, but what about the actual data …
The General Approach Taken by the Industry – Protect The Infrastructure
• EmailHow can the firm protect the future of the email message beyond the initial transmission?
• Deal RoomsHow can the firm control the file after it has been downloaded onto foreign network?
• Drop Box/iCloudHow can the firm protect the client when content proliferates beyond the firm’s control?
• Mobile DevicesHow can the firm protect content on mobile devices, removable media and home PCs/Macs?
• Human FactorHow can the firm protect against the busy lawyer that does not abide by firm security policies?
Some Other Things to Consider When Protecting Client Data
• Why Digital Rights Management (DRM) • Protect what is ‘yours’ from misuse• Misuse is accessing confidential information
without authorization• Enables proactive control over content• Extends content custody beyond the perimeter
Digital Rights Management – The Next Level of Threat Protection
What is the Security-Convenience Equation when Dealing with Content in Motion?
Secure File Transfer• Integrated into email• No file size limits• Available on mobile• Send and receive files• Full audit trail
Secure Collaboration• Full content control• Simultaneous edits on a single document• Side by side view of all changes• Custody retained• Full audit trail
The Collaboration Landscape – One Size Does Not Fit All
Email and Attachments• Professional
attachment management
• Reply all and BCC protection
Secure File Synchronization• 2-way exchange of shared
folders• No file size limits• Granular security• Full audit trailFrequency of interaction
Confidenti
alit
y
• Make it easy for lawyers to do the right thing.... Convenience breeds compliance
• Prioritize defenses based on the balance of risk involved
• Protect the content as well as the perimeter• Booby-trap the data – Snapchat for
documents• Think of outbound risk as well as perimeter
defense
How Can Firms Begin to Fill the Gaps?
Share only what they want to share
Share only with whom they want
Share only when they
want
Share only how they want to share
Imagine A World Where Lawyers...
From Michael:Despite continuous monitoring, robust defense and awareness of network activities the bad guys will get in. 1. Security is a team sport … educate users on how to
play defense and support them with the right tools 2. Focus on controls to manage content and risk of
data exfiltration3. Know what is leaving the firm, protect it in motion
and manage it when it lands outside the firm
Three Take Aways...
From Paul
1. Habitual protection of content that is easy, mitigates risk
2. One size does not fit all 3. Building a fortress from infrastructure up is
essential but not enough. You must also build from the people and the content down
Three Take Aways...
Thank You!
top related