Recent research by the National Cyber Security Centre (NCSC) has found UK law firms are increasingly appealing targets for cybercriminals interested in stealing and exploiting client data.
Hybrid working has been cited as a challenge for firms attempting to maintain secure working practices and protect client confidentiality, but as cyberattacks become more sophisticated, the data that law firms hold are targeted for ransomware and insider trading.
Proactive steps and training
These cyberattacks are increasingly carried out through breaches attributed to human elements, with 74% of all data breaches involving errors like privilege misuse, phishing, stolen credentials or social engineering. But losing client data has harmful consequences to the customer's trust and reputation, leaving firms with the hard task of regaining their professional status amidst shoring up their security from other follow-up attacks.
These cyberattacks are increasingly carried out through breaches attributed to human elements
The report calls for more proactive steps and training to protect their legal services. Financially motivated extortion incidents and intellectual property thefts have a significant impact on the legal sector in comparison to other civil sectors, so it is only more integral that their security can match potential threats and strengthen their ability to protect client data.
Confidential client information
“The UK legal sector handles data that is ultimately a critical component for business continuity,” says Mark Appleton, Chief Customer Officer at ALSO Cloud UK. “Cyber security remains an issue for any process wholly or partially reliant on technology, including those facilitated online, via email or any device."
“Criminal organisations identify law firms for their funds but more importantly, the abundance of confidential client information that can be used in negotiations and litigations. With the increased cyber threats they face, investing in the right security tools to become more resilient to the various attack methods should be a necessity. Otherwise, they face dealing with losses that may prove crippling for their firm’s reputation and clientele.”
Aspect of external threats
Operational cyber security needs to be addressed at all points of defence where possibleAppleton additionally agrees with the guidance offered to the legal sector, and that operational cyber security needs to be addressed at all points of defence where possible.
Mark Appleton continued: “Businesses have limited visibility over every aspect of external threats, but updating your security where you have control is a priority. With the proliferation of data breaches and privacy concerns, effective cybersecurity begins internally.”
Cyber security and data protection
Mark Appleton added: “Investing in cyber defences and training staff to improve policies and security procedures is key, but also ensuring that agreements with MSPs and other third-party vendors include appropriate cyber security and data protection to safeguard digital assets is a responsibility that cannot be neglected. With frequent engagement with external entities, ensuring that access points are limited in the era of cloud computing should be the new normal for business security.”
“The legal sector needs to find an approach that facilitates their business functions but most importantly protects their data to ensure both their long-term success and commitment to their clients and ensures business continuity.”
