Article

A Roadmap for Lawyers With Cybersecurity Paralysis

August 15, 2019

We understand why lawyers have cybersecurity paralysis. They don’t understand cybersecurity, experts disagree on the best steps to take, the majority of cybersecurity measures involve spending time and money – and to top it off, the threats and defenses against those threats change daily. Here’s a brief roadmap to where you should be going.

By the Numbers: Where We Stand Today
Thanks to the ABA’s 2018 Legal Technology Survey Report, we have some solid numbers to ponder as we construct our roadmap. Looking strictly at the big picture statistics, these were the ones we found most significant.

  • 23% of respondents reported that their firm had been breached at some point.
  • Of those reporting that they had been breached, the percentage breached generally increased with firm size until you got to large firms – 14% were solos, 24% for firms with 2-9 and 20-49 attorneys, 42% with 50-99 attorneys, and 31% with 100+ attorneys.
  • 60% reported that their firms had not experienced a data breach. It is important to note that it is extremely possible that many firms experienced a breach and never detected it.
  • 9% of those breached notified clients and 14% notified law enforcement.
  • Of those breached, 41% reported downtime/loss of billable hours, 40% reported consulting fees for remediation of the problems, 11% reported loss or destruction of files, and 27% reported replacement of hardware/software.
  • 40% reported experiencing an infection with viruses/malware/spyware, with the greater number occurring in firms with 2-49 attorneys and the lowest in firms with 500+ attorneys.
  • 34% reported having cyberinsurance coverage (the percentage is growing, but slowly).
  • 24% reported using full-drive encryption, a low number in these days.
  • 29% reported using encryption of email for confidential/privileged data sent to clients.

Without bombarding you with numbers, the smaller the firm, the less likely it was to have a policy covering document retention, acceptable computer use, remote access, social media, personal technology use and employee privacy.

Read the entire article here.