- Security TWENTY
- Women in Security
Most cyber breaches in the legal sector are by insiders, suggests a firm that offers a cloud-based content services platform for law firms, corporate legal teams, and compliance departments. Based on data from the UK data protection regulator the Information Commissioner’s Office (ICO), between the third quarter of 2019-2020 and second quarter of 2020-2021, some 75 percent of identified data breaches in the legal sector (where the origin could be identified) were caused by insiders, as opposed to only 25 percent caused by outside threats, such as external malicious actors.
The findings highlight, says NetDocuments, the need for law firms to remain vigilant, invest in data security and adopt the right governance controls. This includes data encryption, the ability to control how documents are accessed or used and enabling data to be wiped remotely if lost or stolen.
Guy Phillips VP of International Business at NetDocuments says: “Understandably there has been a lot of focus on external threats to the legal sector. However, as these findings show law firms can take their eye off the ball when it comes to insider incidents. Whether users are malicious, naïve, or careless, the reputational and financial damage can be huge. This is why law firms must put in the right security controls to protect themselves and put in place comprehensive management of user access to documents and files.”
The analysis of the ICO data points to common causes of data breaches in the legal sector:
– 50 percent of data breaches in the legal sector occurred from sharing data with the wrong person (via email, post or verbally);
– 17 percent of data breaches occurred from losing data (loss or theft of device containing personal data, or of paperwork or data left in insecure location); and
– 57 percent occurred from human error (verbal disclosure; failure to redact or use bcc; alteration of data; hardware mis-configuration; documents emailed or posted to wrong recipient)
Guy Phillips adds: “The shift to remote and hybrid models of working has only increased the potential security risks, as more documents and files are being shared and accessed from dispersed locations. Law firms need to ensure that they have a truly holistic approach to Data Loss Prevention to allow more control over how files are accessed and what users can do with them. Data protection and encryption should be at the core of a document management platform, with the aim of gaining complete control over data privacy and regulatory compliance with no impact to productivity or performance.”