Risk Management: Protecting Your Law Firm from Ransomware

Posted in Uncategorized On February 22, 2018

In my last blog, I talked about “The Rise and Rise of Cyber Crime” and in today’s article I wanted to share some advice on combating one particular form of cyber-crime that is particularly prevalent at the moment – namely ransomware.

Ransomware attacks, like the WannaCry cyber-attack which so devastated the NHS last year, occur when cyber criminals hold your data to ransom by encrypting it and demanding money for its decryption. This is an extremely fast-growing area of cyber-crime as there are fewer and fewer barriers to entry for anyone so inclined to try their hand at digital extortion – indeed would-be cyber-criminals can even purchase ransomware toolkits, making it easy for those with only basic technical knowledge to launch their own attacks.  It is not surprising then that the number of ransomware attacks on businesses is ever increasing with research by Kaspersky revealing that a business is attacked with ransomware every 40 seconds. Worryingly, recent statistics published by Barkly also revealed that 71% of companies targeted by ransomware attacks have been successfully infected, suggesting that many firms cyber defences are struggling to keep up with the ever changing threat landscape.

The impact of such an attack can be devastating to the financial and structural stability of a law firm. To give you a flavour for the impact, a survey conducted by Datto and Timico last year, which included 250 law firms and 750 other UK businesses, revealed that:-

  • 88% of law firms who were hit by this kind of attack experienced systems downtime of a week or more.
  • 33% of law firms lost access to their data for more than a month, while 14% said it was “unrecoverable”.
  • The effects of the attack were almost instant with 68% stating their data systems went from fully functional to essentially useless within seconds or minutes.
  • 53% estimated it cost their firm between £1000-£2000 a day in lost revenue, due to systems being down. A third of law firms could not estimate the overall cost to their business, describing it as “unquantifiable”.
  • More than a quarter of law firms ended up paying cyber criminals £5000 or more to retrieve their data.

On top of the operational and financial impact of such an attack, the access to a firm’s confidential client data by an unauthorised outsider also poses a significant threat to client confidentiality and therefore SRA compliance. Furthermore it also risks a breach of data protection compliance and, with the imminent arrival of the stringent requirements of GDPR, this in turn not only risks significant fines but also leaves the firm open to massive reputational damage.

So what can law firms do to protect themselves from such threats?

Well ransomware can be transmitted in 2 main ways: traditionally this was via fraudulent emails which relied on staff clicking on a link or attachment which delivered the ransomware to their network.  Whilst this is still common, last year cyber-criminals found a much more powerful way to bypass user interaction altogether and deliver ransomware via security vulnerabilities. The Wannacry outbreak is a perfect example of an attack that targeted a security vulnerability in Microsoft’s operating system to access and infect machines without any employee clicking on a rogue link.

Combating the threat from ransomware therefore requires a blend of effective security patching policies, staff training, security technologies and company policies and emergency protocols in order to form a cohesive defence strategy. Given it only takes one device to not be security patched for ransomware to enter and infect your firm’s network, the procedures for applying security updates need to be stringent and rigorously adhered to, with business processes in place to ensure they happen in a timely fashion and that no PC, server or device is omitted.

For the worst case scenario, it is also important that law firms have a sound data backup strategy which they can fall back on, more about which can be found in my blog Preparing your Law Firm for GDPR: Data Backup”.

There’s no doubt that ransomware is a particularly complex threat to manage, and needs dedicated resources and strict procedures which are rigorously adhered to.  As with other cyber threats, I think that is probably why so many firms are now moving towards partnering with a specialist IT company to provide this function, someone who can monitor their system from a security perspective at all times and is not distracted by the day-to-day operations of the firm.  This is certainly the trend we’re seeing here at Stonegate IT, where we are working with law firms to provide fully managed services which deploy all security updates to their network in a structured and timely manner and flag an alert should any monitored device not be up to date, so that prompt analysis and remedial action can be taken. We are also engaged in delivering highly secure and effective data backup strategies and systems, which ensure that all data is backed up centrally, to a secure onsite vault that is not web facing and from which it can be swiftly recovered if needed.

If this article has raised questions or concerns over your firm’s cyber security strategy and you would like more information on ways that Stonegate IT can help to mitigate the risks, please do not hesitate to contact me on 020 3761 3520 or email smohr@stonegate-it.co.uk when I will be happy to chat through the issues and discuss ways we can help.

For more information about our services for law firms please feel free to visit our website.

To view other articles in our library of informational resources for law firms, please visit my blog.

Established in 2005, Stonegate IT provides IT consultancy, IT services and IT support to small and medium size law firms, solicitors and legal services companies in Kent, East Sussex, London and the surrounding area.

As specialists in working in highly demanding environments, where the highest levels of confidentiality and risk management are paramount, we fully understand the challenges law firms and solicitors’ practices face in building and maintaining systems that can maximise the business advantages technology can offer them, whilst minimising their risks around issues such as cyber-crime, breaches of confidentiality, data protection and GDPR and ensuring compliance with the SRA and Law Society regulations. For more information about our services for law firms please visit our website https://www.stonegate-it.co.uk/services/it-support-law-firms/