The Who, How and What to do of Cyber Attacks

Guidance for Legal Practitioners The Who, How and What to do of Cyber Attacks

The legal sector deals with valuable and often confidential data, it facilitates large transactions on a daily basis and provides access to all kinds of businesses across the supply chain.

All these factors make law practices extremely high value targets for cyber attacks.

Who is attacking you?

1. The majority of cyber attacks are carried out by criminals who are motivated by financial gain.

As highlighted by Crowe UK, statistics show that cyber crime now accounts for over half of all crimes committed. 2. Threats can also come from your competitors or through your supply chain. 3. A significant threat, often under-estimated, is one from your own staff. A disgruntled current or former employee can act to get revenge or simply for financial gain.

How are you being attacked?

Threats to law practices involve the full array of cyber-attack methods, including phishing emails, ransomware, hacking, denial of service attacks, and the ever-evolving strategies of social engineering.

Due to the frequent movement of funds through company bank accounts, law firms are particularly vulnerable to fraud. Conveyancing fraud is now so common that it even has its own nick name. It involves those who are about to complete on a sale or purchase of a new home. Someone from the finance team in the solicitor’s office may be conned by a fraudulent email or phone call advising them that client account details have changed, or indeed the customer may be deceived into paying a large payment into a criminal account. Sadly, those involved realise too late that they have been victim to ‘Friday afternoon fraud’.

Untargeted attacks

Cyber criminals attack law firms intentionally, yet also and more commonly, indiscriminately. In fact, the majority of cyber attacks are untargeted and use commodity tools to attack large numbers of devices, services and users at the same time in a random way. Most cyber attacks are made up of repeated stages that are probing for further information that can lead to a more targeted attack. These attacks exploit basic weaknesses that can be found in many organisations such as poorly configured firewalls, software that hasn’t been updated and legacy computer systems that are no longer supported. 90% of all cyber attacks starts with a phishing email (a fraudulent email sent by cybercriminals that mimics a legitimate communication from a trusted source). Vishing is the name given to a fraudulent phone call, where someone pretending to be from your bank, a trusted company or service, or even the police will try to trick you into revealing personal or confidential information. These can be part of a wider campaign where fraudsters are gathering information for a larger attack.

Ransomware

In the last couple of years, ransomware has become one of the most popular cyber-attack methods that cybercriminals use to target law firms. A typical ransomware attack begins with a phishing email which usually contains a link and a message designed to encourage the recipient to click the link. Once clicked, the ransomware installs on the computer. Ransomware encrypts an organisation’s files rendering them inaccessible until either a ransom is paid, or the organisation reverts to backups to bring the network back online.

Ransomware can also be delivered into a practise’s system by hackers who are able to exploit a vulnerability somewhere in the network. The attacker is often able to access the company network so they can sabotage systems and steal information.

Double-extortion ransomware

Many organisations are now prepared and have appropriate backups in place to mitigate a traditional ransomware attack. A doubleextortion ransomware attack, however, allows the attacker to increase the likelihood of receiving a ransom payment by threatening to leak stolen data onto the internet. Sensitive and confidential information appearing on social media can clearly be a reputational disaster for any practice.

Distributed denial of service attack

It is not difficult in today’s world to arrange a distributed denial of service attack (DDoS) against someone’s website or online services. A DDoS attack is launched using an army of connected devices (known as a botnet) that are infected with malware in order to allow them to be controlled by a central computer. The attacker can then command the botnet to bombard the website server with a flood of requests which overloads the server until it crashes, taking it out of use. Hacktivism

Law firms who are linked to politically or environmentally sensitive cases could be the target for hacktivism. This is the act of hacking, or breaking into a computer system, for a politically or socially motivated purpose.

Insider data breaches

An “insider” data beach describes a breach which has been generated by one of your staff. The majority of insider data breaches are accidental and the best way to combat these are through training and robust processes and controls. However, insider data breaches also include employees stealing confidential information from the firm, often in order to leak to competitors, cybercriminals, or take to a new job.

How do you protect yourself?

The Cyber essentials controls will help an organisation defend against most un-targeted attacks. The process of putting in place the five core controls will eliminate all the common security gaps that up to 90% of cyber attacks rely on.

Remember, even targeted attacks, usually start with simple attacks such as a phishing campaign. The National Cyber Security Centre (NCSC) recommends a multi-layered set of mitigations to improve your organisation’s resilience against phishing attacks.

Cyber Essentials focuses on five technical controls that form key elements in the layers that will help mitigate a phishing attack and other un-targeted cyber attacks. • Even if a malicious link is clicked, securely configured devices decrease the impact of malware on the wider system or stop malware installing in the first place. • Security update management can prevent attackers from using known vulnerabilities.

Using supported software and devices and making sure they are kept up to date with the latest software updates, as well as buying software and apps from trusted sources, reduces the opportunities for hackers. • Accounts can be made more secure by adding two factor authentication to the log-in processes. This will mean that, even if credentials have been compromised, an attacker cannot gain access. The number of accounts with privileged access should also be limited to the absolute minimum to reduce the potential damage from a cyber attack. • People with administrator accounts should

not use these accounts to check email or browse the web and this should prevent users accidentally installing malware from phishing emails or malicious websites. • To limit any potential issues from former employees, immediately remove or suspend accounts that are no longer being used, It is also good practice to limit or block the use of

USB and other portable removable media and devices. • One of the largest human-factor risks are staff re-using their passwords on different on-line accounts, especially where they reuse personal passwords on work accounts. When this happens, a breach of any of the accounts where that username-password combination is used can result in access to all accounts.

Consider reviewing your password policies, doing so may reduce the likelihood of staff re-using passwords across home and work accounts.

Ensure that passwords are changed if it is suspected that one has been compromised. • Anti malware software will block most malware from downloading and prevent users accessing insecure websites.

Supply chain risk

If you outsource your IT to a third party provider, the security risk to your network remains your responsibility. Do you know the cyber security status of your IT provider? Never take this for granted as being an IT expert is not the same as understanding cyber security. It is recommended that your IT provider is certified to Cyber Essentials as a minimum. Third party IT providers may look after the networks for numerous businesses and have administrative privileges to all their systems. It is vital that you are reassured of the security measures that your provider has in place to protect you and itself.

iASMe Governance is a comprehensive yet affordable risk-based standard for SMEs that covers the 5 core controls of Cyber essentials, focused on defending against internet threats, as well the other, critical aspects of cyber security in your organisation . These include having a risk assessment and a security policy, security awareness training for staff and all the GDPR requirements. IASME Governance also covers other important areas such as backing up your data, and having an incident response and business continuity plan.

IASME Governance is aligned to a similar set of controls as the international standard, iSO 27001, but is more affordable and achievable for small and medium sized organisations to implement. In recent years, an increasing number of large organisations have started to accept the audited IASME government certification as an alternative to ISO 27001 for the small companies in their supply chain.

Counter fraud

It is widely recognised that up to 90% of fraud is now cyber enabled, however a great deal of fraud still occurs through interactions with people, whether it be a scam phone call, or a dishonest employee. The Counter fraud fundamentals (Cff) scheme was developed by IASME and a team of counter fraud experts in partnership with Open Banking Implementation Entity. The scheme is an ideal way for any business dealing with financial transactions to prove to their customers and supply chain that they take their responsibility to combat fraud seriously.

The process of working through the CFF self-assessment questions helps a practise identify whether they have adequate counter-fraud measures in place to prevent, detect and respond to fraud. It provides an opportunity to improve. The questions are centred around the company, it’s employees, the responsibilities for reporting fraud, and managing and documenting fraud risk. Counter fraud measures involve awareness, staff training, staff monitoring, and having polices and strategies in place to prevent and detect crime.

The Cyber Security certifications address the technical side of a cyber breach which could be used to commit fraud, whereas, Counter Fraud Fundamentals fully addresses the human element of fraud, the intention to trick or deceive, which can of course, take place against an organisation without a cyber element.