Law Technology Today From the ABA Legal Technology Resource Center
Related Articles
In the last decade, cybersecurity has become a major concern for businesses. A threat that was once paid lip service now dominates headlines on a monthly, if not weekly, basis. WannaCry and the latest Petya variant of ransomware have made international news as consumers reflect on how a data seizure would impact their work.
In 2015, the U.S. Computer Emergency Readiness Team (US-CERT) reported an average of 1,000 ransomware attacks a day. By comparison, in 2016 US-CERT reported an average of 4,000 daily cases of ransomware attacks, highlighting the increasingly common use of this tool in malicious actors’ arsenals.
The legal industry has been the target of a number of malicious campaigns, some made prominent—including the “The Office of The State Attorney” phishing case disclosed by the New York State Office of the Attorney General in November.
When dealing with the sheer amount of data and access points relevant to firm security, any security team will struggle to filter, analyze, and secure its technology infrastructure. Most security teams are drowning in data and need the support of multiple programs and third-party vendors. And these various touch points each present their own risks.
In this environment, some firms are increasingly and incorrectly writing-off cybersecurity and losses from cybercrime as a modern cost of business. It’s not hard to understand why. The FBI recently reported that between 2013 and 2016, business email compromises resulted in the exposed dollar loss of $1.5 billion in the U.S. McAfee estimated the global cost of cybercrime at $400 billion, while Symantec reported that in 2015, 43% of spear phishing campaigns targeted companies with less than 250 employees.
The statistics are seemingly endless for both Fortune 500 and small enterprises. However, firms and security teams swarmed by data don’t need to defend against threats by themselves. Since 2015, a number of firms have been working together as a community to separate threat information from innocuous data streams, effectively broadening their security footprint for a fraction of the cost of building out a large security department.
The Legal Services Information Sharing and Analysis Organization (LS-ISAO) is a non-profit organization led by law firms to facilitate sharing and analysis of physical and cybersecurity threats facing members. It serves as a cyber “neighborhood watch” for the legal services community, helping the industry secure intellectual property, protect clients’ data, and preserve revenue streams and reputation.
Last year, LS-ISAO and its partners shared more than 5,000 actionable intelligence alerts and vulnerability advisories. Information shared included advanced phishing attempts and malware payload activity, as well as details on trojans and business email compromise attacks.
Its 120 member firms from the United States, United Kingdom, and Canada work together for mutual defense against criminals, hacktivists, and cyber-spies. The organization also recently opened membership to firms headquartered in Australia and New Zealand for expanded threat visibility in the Asia-Pacific region.
The growth of LS-ISAO is evidence that firms are taking proactive steps as responsible stewards of client information, and are committed to defending themselves in today’s environment.
