The risk of a cyber attack is extensively growing for businesses in the legal sector. This is happening for many reasons, most noticeably, due to the amount of confidential information and client money a firm manages. Considering the sensitive nature of data held by a firm, any kind of breach can be considered catastrophic.
In the years 2016-17 alone, the SRA reported an £11 million loss of client money stolen by cyber criminals.
Like all businesses who handle sensitive information and high-value transactions on a daily basis, every law firm will be viewed as a lucrative option for cyber criminals who have increasingly become more focused on profitable exploits.
When measuring cyber risk risk, does business size matter?
Short answer: No. When measuring your cyber risk, it is a common misconception to assume that cyber criminals will only be interested in pursuing larger firms. Unfortunately, this assumption could not be further from the truth. Smaller firms are considered equally attractive options to their larger counterparts in the eyes of a cyber criminal as they often have limited cyber security resources or awareness within their firm. The lack of in-house IT and InfoSec capabilities within smaller firms make smaller firms ‘easier targets’ for cyber criminals.
The National Cyber Security Centre (NCSC) have identified four dominant cyber threats to the UK’s legal sector as:
From this list, phishing attacks have easily become the most common method of attacks due to their low-cost to high-reward ratio. The PwC Law Firms’ Survey 2020 revealed that every respondent suffered a security incident in 2020, a trend continuing from 2019, with phishing being the most common attack method frequently in the form of email.
The easiest way to minimise risk against phishing attacks is to first have a secure email setup, preventing the malicious content from ever reaching your email inbox in the first place. While many firms already view their email setup as secure, often the standard setup covers only the basic security settings. To check your setup, feel free to email dmarc@emailsecurity.im to receive instant automated feedback about your settings or reach out to us for a free assessment.
With your email secured, employees are statistically the next weakest link in your cyber security posture. There are several additional simple steps which can be taken to enhance maximum protection of your firm, employees and your clients. Effective law firm cyber security requires a thorough understanding of your company’s digital environment and risks you face. The first step to an improved cyber security posture is to conduct a comprehensive cyber risk assessment by a trusted cyber security partner.
The comprehensive Riela Cyber risk assessment is considered the first step in discovering your law firm cyber security posture as it enables transparency, visibility and insight into your online estate, allowing for a better understanding of what your security looks like and how it could be improved.
Once you have received your security snapshot, our team will evaluate which areas of your firm could pose a threat to your security, giving you a number of recommendations on how to minimise the risk of a security incident.
Cyber security systems and procedures are only effective if your employees are aware and understand the cyber security threats to your firm. Research indicates that around 9 in 10 incidents occur as a result of human error. Therefore, ongoing training of your employees on how to handle emails, identify suspicious activity and browse online securely is a key part of any successful cyber security and risk management framework. Using tools such as endpoint management to limit employee internet activity to secure webpages and email filtering systems to block suspicious emails can reduce accidental data breaches further.
Security training is often considered ‘boring’, something you do once to check a box and then never engage with again. When deciding how we would provide cyber security training, we kept this in mind, choosing to do the opposite. Our cyber security training promotes evidence-based behaviour change to actively encourage and educate best-practices within staff. In the example of phishing scams, this can be reflected through the simulated emails we will randomly send to employees to test their ability to spot scams.
Securing your data by following data control and access guidelines can reduce the risk of data leaving your network uncontrolled. You should always ensure that only people who need access to sensitive or private information should have access and that all data is encrypted and backed up.
Following ‘least privilege’ guidelines ensures that only staff who need to access certain documents can do so, limiting accidental exposure of your data or worse, theft of highly confidential data by a disgruntled employee which was the source of some major data leaks at law firms recently. Data loss prevention systems can significantly enhance your security by monitoring access to and transmission of certain files by employees or within your network.
Law firms should further restrict employees to corporate controlled laptops and phones as much as possible, keeping personal devices separate from corporate data and systems. By enabling multi-factor authentication, firms can significantly reduce the risks of brute force password compromises.
Regular automated patching of systems is often overlooked or limited to laptops and phones.
What few companies know is that many incidents can be prevented by ensuring all your software, including servers and routers, are always on the latest software update. Software developers such as Microsoft release new versions (“patches”) once a new vulnerability of their systems has been identified. If you continue to run on an older version, your entire system is at risk as a simple Google search for software vulnerabilities will confirm.
Automated patching isn’t complicated or expensive. There are simple software solutions available which monitor the compliance of all your connected systems and request updates when new versions are released. By following this simple process, your company can already significantly reduce the risk of incidents.
Once you have implemented best practice cyber security protocols and procedures, it is time to verify your success by gaining government approved certifications to showcase your secure operations. Not only will this be a good exercise to gain greater insight into your cyber infrastructure, but it will also reassure your clients that their confidential data and money is secure with your firm.
The UK government has developed various cyber security accreditations for companies to show their commitment and awareness of cyber security.
Starting with the NCSC’s Cyber Essentials, which is a self-assessment questionnaire to assess your basic cyber security posture to the Cyber Essentials Plus, which includes an external verification of your setup and the full IASME Governance accreditation which includes everything from GDPR to backups and incident response procedures, the accreditations are designed to improve your cyber security posture and reduce the risks of the most common vulnerabilities and threats.
The UK’s Cyber Security Breaches Survey 2019 shows that only 16% of organisations have a formal cyber security incident response plan in place. Law firms are more prepared than the average UK company but, according to the UK’s Cyber Security Breaches survey, only 40% of law firms have an appropriate Incident Response plan in place.
An effective Incident Response plan will help your firm recover from a cyber attack or data breach. In order to be effective, an Incident Response plan should classify the various types of data, impacts of a data breach and their respective responses. Developing an Incident Response plan requires a detailed understanding of your company’s environment, starting with your Data Recovery plan and Business Continuity plan.
We recommend a proactive approach to digital infrastructure protection. As threats and risks are constantly evolving, maintaining an up-to-date response plan is critical in order to significantly reduce the impact and damage a cyber event can have. An incident response plan doesn’t have to be complicated. It will not replace your day-to-day security measures but instead act as a method to put in place the correct procedures to minimise damage.
If you do not have an Incident Response plan in place, Riela Cyber can assist you in mapping your environment and offering advise on how to effectively recover your data or mitigate the impact from a cyber attack. While cyber insurance will be able to compensate you in monetary terms, only a dedicated cyber security operations centre (SOC) can assist you in mitigating the impact from an incident.
Starting with the NCSC’s Cyber Essentials, which is a self-assessment questionnaire to assess your basic cyber security posture to the Cyber Essentials Plus, which includes an external verification of your setup and the full IASME Governance accreditation which includes everything from GDPR to backups and incident response procedures, the accreditations are designed to improve your cyber security posture and reduce the risks of the most common vulnerabilities and threats.
Stay updated with our latest blogs and company updates.
Kurt Schrauwen is a Director of the Riela Group of companies which includes Riela Yachts, Riela Cyber and Riela Tech.
Kurt brings more than 20 years of leadership experience having been an early part of the global success of Microgaming in becoming a market leader. Kurt was responsible for the commercial, contractual, and technical sales for Microgaming and with this experience will complement the company’s growth strategy.
Kurt is passionate about business optimisation and prides himself in having an intrapreneurial outlook to maximise staff potential, reduce inefficiencies as well as identifying and maturing revenue growth opportunities.
Paul Cocker joined the Riela Group in late 2021, after spending just under 20 years with his previous employer.
Paul is responsible for the Riela Tech service levels, working on both the dispatch function and SLA management. Paul carries out a variety of duties across the Network Operations Centre and works closely across the wider team to deliver professionally tailored solutions for our Riela Tech clients.
Something isn’t Clear?
Feel free to contact us, and we will be more than happy to answer all of your questions.
Murat Guner joined the Riela Group in the Summer of 2021 as an Infrastructure Engineer.
Murat began his career in Turkey as a computer teacher for primary and secondary schools before migrating his skills into IT infrastructure. After honing his IT experiences throughout a colourful career path, Murat gained numerous qualifications which he is now excited to apply to the management of our Riela Tech infrastructure.
Andy is a qualified Network Engineer with in-depth knowledge of architecting, implementing and supporting networking solutions in the SMB, Enterprise and Service Provider environments.
He has over 20 years of experience working across multiple vendor operating systems, including Cisco, Juniper, Linux and Microsoft, and has also been responsible for implementing a variety of large scale network services deployments, taking projects from design to rollout and support.
Andy also has experience of deploying and migrating a range of virtualisation technologies including VMWare, Hyper-V and KVM based systems.
Email: andy@riela-cyber.com
Marc is our Group’s Infrastructure and Managed Services lead with over 18 years’ experience in delivering infrastructure projects across multiple industry verticals and international jurisdictions. From projects in Aerospace and Engineering through to Banking and Insurance, from Europe, China, Africa and Australia.
This experience is matched with a varied list of certifications from leading industry vendors such as Hp, Cisco, Microsoft, Ruckus, CompTIA and more. As a qualified technical trainer Marc is comfortably able to take complicated technical concepts and deliver them in simplistic terms to key decision makers and end users alike.
Most of Marc’s experience has been gained working for managed service providers, both large and niche and as such is able to take real world experience and blend it with industry standards to help align our service delivery with our clients values and processes.
As a Marketing Executive, Alex is responsible for all marketing duties spanning the Riela Group.
Alex joined the Riela Group in August 2020, shortly after graduating with a Psychology degree from Nottingham Trent University.
With past work experience in content marketing, event management and web design, Alex is able to apply her creative and analytical skills into the Riela strategy.
As the Head of Group Sales at the Riela family of companies, Matthew leads the company’s sales strategy, execution, and growth.
Matthew has a successful record building trusted client relationship and delivering upon set expectations. An accomplished sales leader, he delivers a sales process that provides clients with the information and support they need to make the right decisions for their organisations and their constituents.
Matthew has significant experience within the maritime industry having previously worked across various sectors including insurance, security, satellite communications and managed IT. Matthew’s most recent experience encompasses almost 5 years spent with the leading satellite communications and managed IT provider in the maritime industry, focusing on their superyacht clientele.
Christian is involved across the Riela family of companies with particular attention to the technology businesses, Cyber and Tech.
Christian gained a postgraduate Master in Finance degree at the University of Neuchatel, Switzerland and completed his MBA at the University of Chicago Booth School of Business.
Before joining us, Christian worked for six years at Argosy Capital, an Isle of Man-based private equity and venture capital business focusing on early-stage growth businesses. At Argosy, he focused on managing investment companies, research and financial analysis and served as a director on several boards.
Robert Tobin is the Managing Director of the Riela Group of Companies and is responsible in overseeing our business operations, our people and driving excellence in all we do.
Rob brings over 25 years’ of successful leadership and entrepreneurial experience across a range of industries including Family Office, corporate services, construction engineering, Superyachts, cyber security and information technology development to our Group, and to our customers.
In the past 15 years Rob has gained a prominent reputation within the Superyacht industry for his passion, integrity, innovation and achievements to date.
“Being part of an awesome, capable and forward thinking team that have a shared passion for Superyachts, people and the environment is the highlight of my career and puts a smile on my face and a spring in my step everyday”.
Peter is an experienced technology consultant with a demonstrated history of working in the IT and cyber security industry. Skilled in Search Engine Optimization (SEO), IT Strategy, Start-ups, Regulations, and Online Gaming. Strong consulting professional with a DPhil focused in Natural Sciences from ChristChurch, Oxford.
Tim Bliss, Managing Director of Riela Tech since the company foundation in 2015 and Director of Riela Cyber, brings over 20 years’ of successful leadership experience across a range of industries including finance and banking, software development, and manufacturing, as well as cyber security and information technology. Prior to forming the company he led the technology for Manx Financial Group PLC, where he was instrumental in business systems transformation.
“It is our hugely capable team of experts that drives our business – it is fantastic and rewarding to be able to use technology, intelligence, and great customer service to help make our clients’ business and staff progressively more efficient resilient and secure”
