Avoiding the Cyber Clutter: A Practical Guide to Cybersecurity
•Download as PPTX, PDF•
1 like•134 views
Legal administrators are deluged with cyber chatter. Partners are involved, clients are demanding. As part of the leadership of your firm, you must proactively become educated and help your firm protect itself from this new and evolving exposure.
Recommended
Recommended
More Related Content
What's hot
What's hot (16)
Similar to Avoiding the Cyber Clutter: A Practical Guide to Cybersecurity
Similar to Avoiding the Cyber Clutter: A Practical Guide to Cybersecurity (20)
Recently uploaded
Recently uploaded (20)
Avoiding the Cyber Clutter: A Practical Guide to Cybersecurity
- 1. Avoiding the Cyber Clutter: A Practical Guide to Cybersecurity Uri Gutfreund, Risk Strategies Company Tanya Duprey, Tarter Krinsky & Drogin Mark Sangster, eSentire Wednesday, June 28, 2017
- 2. Today’s Discussion • What You REALLY Need To Worry About • Changing Threats • Risk Mitigation • Risk Transfer
- 4. Law Firms? Announced Breach
- 5. Good Morning
- 6. Good Luck!
- 7. JAN FEB MAR APR MAY JUN JUL AUG SEP OCT NOV DEC 10K 30K 20K 40K 60K 50K 70K 80K FINANCE LAW FIRMS TECHNOLOGY LAW FIRMS FACE THE FASTEST THREAT GROWTH 380% ATTACK INCREASE 100% MALWARE INCREASE $200K AVG BREACH COST
- 8. Who is the Weakest Link?
- 9. New Client - Congratulations! Oh oh… • Questionnaire • Audits • “shall indemnify, defend and hold harmless XXXX from and against any and all Damages arising..”
- 10. ATTORNEY State Breach Notification Laws FIRM State Bar Professional Ethics Code STATE ABA Professional Conduct Code INDUSTRYLEGAL Industry Obligations and Penalties CLIENT REGULATORY DUALITY
- 11. AOP Most At Risk • Personal Injury • Banking • Med Mal / Healthcare • Class Action • Real Estate • Trusts & Estates • Corporate M&A
- 12. INDUSTRY RANSOMWARE CAMPAIGN DECEMBER 2016 Email subject line: “The Office of The State Attorney Complaint” which alluded to vague legal action against the firm PDF ATTACHMENT Claimed to contain details of the legal action Actually contained Ransomware THIS WAS EASILY DETECTABLE • Legal action cannot be served by email! • Sent from Outlook.com domain not GOV EASILY PREVENTABLE • Security Awareness Training • Email filtering • Attachment blocking • eSentire MDR
- 13. Unauthorized Release of Private Information IMPACT • Reputation • Down Time • Cost of Repairs • Breach Costs • Regulators / Fines • Theft of Funds
- 14. RANSOMWARE IS A BILLION DOLLAR INDUSTRY 40% spam email contains ransomware 60% infections stem from spam emails 40seconds a company falls victim 150K in ransom payments $ 70% of companies pay the ransom 10K lost billable hours per attorney $
- 15. COMBATING RANSOMWARE 02 EXECUTIVE Client Notification Disruption Plan 03 INFO SEC Backups & Testing 04 INFO SEC Application Whitelisting 01 DIRECTORS Payment Policy 05 INFO SEC Application Controls 06 INFO SEC Ad Blocking 07 EMPLOYEES Training & Alerting
- 16. OBLIGATIONS Do you know what legislation governs the data you have? INVENTORY Do you know what data you have? RISKS Do you know what cyber threats are targeting your firm? AWARENESS Do your employees know how to avoid cyber risks? PROTECTION How are you defending your firm from cyber threats? CYBERSECURITY MUST-HAVES REPORTING Can you demonstrate your cybersecurity claims?
- 17. A “Cyber” Policy
- 19. Privacy Insurance Security & Privacy Liability Media Content Liability Network Interruption Cyber Extortion &/or Cyber Terrorism Data Restoration Event Management Expenses Third Party Coverages (Negligence) Retention Each Claim $5,000 - $1M First Party Coverages (Costs)
- 20. Event Management Expenses • Data Breach Coach Expenses • Forensic Investigation • Crisis Management Expenses • Privacy Breach Notification • Credit Monitoring
- 21. Policy Purchase Checklist • AM Best Credit Rating • Policy Limit • Data Security & Privacy • Media Liability • Network Interruption, Forensics & Data • Restoration • Event Management Expenses • Regulatory Defense & Penalties • Cyber Extortion • Social Engineering • Fraud
- 22. You Are in Trouble if Your Cyber Policy… •Has sub-limits •Third Party Only •Too small limits •Doesn’t cover employees •Doesn’t cover fines •Exclusions •Costs too much •No prior acts
- 23. Trends in Underwriting 2017 • Less not more • Quicker Not Slower • Cheaper Not Expensive
- 24. CYBERSECURITY WORKBOOKS (based on ABA Cybersecurity Handbook) C y b e r s e c u r i t y L e g a l T a s k F o r c e T H E A B A CYBERSECURIT Y H A N D B O O K A R E S O U R C E F O R A T T O R N E Y S , L A W F I R M S , A N D B U S I N E S S P R O F E S S I O N A L S
- 25. Cyber Breach Service Plan
- 28. • Cyber Strategy • Do Training • Make breach plan • Stand Alone Cyber Liability Insurance • Consider if you want to arrange resources in advance
- 29. Positive Signs for the Future • Major marketing opportunity for your firm to be known as a cutting edge safe firm and extra services • Most of the risk can be handled by an insurance policy
Editor's Notes
- Disable wscript.exe to stop JavaScript files (.js files) Disable Microsoft Word macros via GPO to block malicious document files Disable Powershell (restrict to IT personnel only) Deploy Email Filtering to restrict emails that contain unnecessary attachments: .js, .wsf, .zip, .docm, .vbs, .exe, .msi, .dll, and .html.
- Offer copy of workbook