Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Cyber Risk in e-Discovery: What You Need to Know
Similar to Cyber Risk in e-Discovery: What You Need to Know (20)
Recently uploaded
Recently uploaded (20)
Cyber Risk in e-Discovery: What You Need to Know
- 1. © Relativity. All rights reserved. Cyber Risk in e-Discovery: What You Need to Know
- 2. © Relativity. All rights reserved. Nik Balepur Solutions Architect, Relativity John deCraen Senior Director of Global Cyber Risk Services, Alvarez & Marsal Disputes and Investigations, LLC
- 3. © Relativity. All rights reserved. Why Cybersecurity Is Important
- 4. © Relativity. All rights reserved. Industry Attention to Cybersecurity • Most litigation support and data processing firms have not earnestly undertaken the fundamentals of cybersecurity and are at risk for infection from their clients’ imported data • Very little in the way of regulation or governmental guidance Effective cybersecurity starts with the fundamentals
- 5. © Relativity. All rights reserved. Three Pillars of Cybersecurity
- 6. © Relativity. All rights reserved. Examples: • Import of unknown client data – Processing of Advanced Persistent Threats (APT) – Infection of third-party review systems • Perimeter attacks – Perimeter attack and breach – Access to client or other sensitive data • Social attacks – Productivity attacks (ransomware, DDoS) – Command and Control (CnC) • Internal actors – Corporate or legal espionage – Data theft and sabotage Threats An action, potential action, or inaction, likely to cause damage, harm, or loss “threat” = capability x intent Any activity intended to cause damage or break through defenses
- 7. © Relativity. All rights reserved. Examples: • Import of unknown client data – Porous file transport site – Ineffective malware scanning and detection • Perimeter attacks – Poorly configured or absent web application firewall (WAF) – No Intrusion Detection (IDS) or Prevention (IPS) • Social attacks – Ineffective user training and poor user account management – No file integrity monitoring or HIDS • Internal actors – No Network Access Control (NAC) – Ineffective Data Leakage Protection (DLP) Vulnerability Specific gaps in the protection of assets that can be exploited by threats in order to compromise the asset and realize a risk Weakness to breakage or harm from threats
- 8. © Relativity. All rights reserved. Examples: • Import of unknown client data – Undetected network infection – Infection of third-party productions • Perimeter attacks – Undetected loss of client or company data – Unavailable web applications • Social attacks – Inside-out perimeter breach – Easily established pivot point • Internal actors – Undetectable data exfiltration – Evasive techniques custom developed Risk The resulting damage, harm, or loss of unmitigated vulnerability to threats “risk” = probability x harm The damage caused, real or potential, and costs incurred with breakage
- 9. © Relativity. All rights reserved. Cybersecurity in e-Discovery
- 10. © Relativity. All rights reserved. Applying to e-Discovery Industry-Related Vulnerabilities Ineffective or non-existent data import security Weak detective and defensive posture No plan that considers detected malware in responsive evidence No regulatory or legal guidance for data analytics companies Myriad of client industry-specific regulations
- 11. © Relativity. All rights reserved. Applying to e-Discovery Industry-Related Risks Production of infected data to client, counsel, or the court Findings of regulatory non-compliance for your client or your company Loss of reputation as trusted provider Reduced revenue
- 12. © Relativity. All rights reserved. Cybersecurity Realities The e-discovery lifecycle: • Has unique cybersecurity vulnerabilities to mitigate • Generates unique cybersecurity risks to consider
- 13. © Relativity. All rights reserved. Cybersecurity and the EDRM 1. Information Governance, Risk, and Compliance • Unknown or misidentified and widely variant ambiguous regulatory controls • Misunderstood or ignored industry specific security threats • Underdeveloped or absent enterprise security policy • Absent or ineffective corporate security governance and auditing 1
- 14. © Relativity. All rights reserved. Cybersecurity and the EDRM 2. Preservation, Collection, and Import • Data collectors and forensic examiners unaware of specific risks • Unhygienic collection methodologies • Poor data segmentation • Processes that do not account for likely sources of infection (advanced malware scanning) 2
- 15. © Relativity. All rights reserved. Cybersecurity and the EDRM 3. Processing and Analysis • Potentially infected files processed within the evidence population • Infection of processing and review systems as well as the corporate network • No network segmentation • Ineffective or absent network and server log aggregation and analytics 3
- 16. © Relativity. All rights reserved. Cybersecurity and the EDRM 4. Review and Production • Infection of review hosts (internal, opposing counsel, third-party contract attorneys) • Infection of federal and state regulators or other governmental organizations 4
- 17. © Relativity. All rights reserved. Contributing factors: • Cybersecurity awareness that is lacking or under informed • Refusal to acknowledge threats • Culture of ignoring risks and vulnerabilities over revenue • Inexperience • Hubris The number one driver in most cybersecurity breaches is ineffective leadership and culture “Risk comes from not knowing what you are doing.” – Warren Buffet 1 Breach Causality
- 18. © Relativity. All rights reserved. Mitigating Risks
- 19. © Relativity. All rights reserved. 1. Use hygienic and secure collection methods 2. Understand the source data environment as well as any client data security measures and industry-specific regulatory burdens (HIPAA, PCI) prior to collection 3. Ensure your FTP server is FIPS compliant 4. Employ proper data and network segmentation 5. Use advanced malware scanning for imports and if you outsource pre-processing, ensure your vendor does as well 6. Develop infected file protocols and reporting, and leverage pretrial conferences to set expectations for alternative delivery for infected files 7. Use advanced malware scanning for exports Mitigating Risks
- 20. © Relativity. All rights reserved. Using Legal Hold to Evaluate Develop comprehensive subject-matter expert focused assessment campaigns Discover vulnerability causation • Validate SME and employee understanding of compliance expectations • Understand gaps in policy and control language • Identify root causes of failures to achieve compliance maturity Measure cybersecurity risk posture and process maturity • Discover processes or functions not meeting expectations • Identify weak or absent detective and protective activities/technologies • Establish baseline and collect historical gap closure success rates Initial intelligence gathering to inform deeper evaluation • Provides ideal starting point for preparing for regulatory level examinations • Identify weak or absent detective and protective activities • Provides for ideal starting point for comprehensive cyber readiness evaluations (CREs)
- 21. © Relativity. All rights reserved. Closing Thoughts Think security first and compliance will be one of the results Think risk astute – You must do a better job at understanding your environment, honestly approach risks and vulnerabilities Ask – What am I not aware of that I could or should be? Why am I not aware of it? Think progressively – your enemies are! Seek expert assistance
- 22. Break new ground and rethink the way you practice e-discovery. • 2,000+ Attendees • 200+ Speakers • 150+ Sessions • CLE-accredited Sessions RelativityFest.com
Editor's Notes
- Nik: Thank you for tuning in to learn about cyber risks in e-discovery. My name is Nik Balepur and I’m a solutions architect at Relativity, helping Relativity users better understand how to make the most of the platform. I’ve worked in e-discovery for about 10 years, managing legal and technology projects. In today’s webinar, I’ll be discussing cyber risks with John deCraen. John presented on this topic at Relativity Fest and we’ve decided to bring it back today based on popular demand. John is a senior director with Alvarez & Marsal’s Disputes and Investigations practice, specializing in global cyber risk services and digital forensics. Joining A&M in 2004 from the finance industry, he has since been involved in computer forensics, cybersecurity, and IT risk matters performing various management, investigatory, and analytical assignments for global clients in a multitude of industries. John, thank you for joining us today. Tell us a little about your background, the types of clients you usually work with, and what makes them unique. John: [Discuss background in cybersecurity, computer forensics, and e-discovery as well as what comes with these large cases that you don't usually see with small litigation]
- Nik: With many high-profile breaches, cybersecurity has become a popular topic in various industries around the world. John, from your experience, how seriously do you think the e-discovery industry takes cybersecurity?
- John: [Overview about current state of organizations’ cybersecurity practices and understanding] There’s very little in the way of regulation or governmental guidance, so it’s up to us to make sure we protect our data and our clients’ data. Effective cybersecurity starts with the fundamentals. Organizations need to understand the three pillars of cybersecurity.
- Nik: What are the three pillars of cybersecurity? Can you provide a few examples of each?
- John: A threat is an action, potential action, or inaction, likely to cause damage, harm, or loss [Capability x intent] [Quick examples (Import of unknown client data, perimeter attacks, social attacks, and internal actors)]
- John: Vulnerabilities are specific gaps in the protection of assets that can be exploited by threats in order to compromise the asset and realize a risk [Overview of using NIST cybersecurity program to define activities and help definite vulnerabilities] [Quick examples (Import of unknown client data, perimeter attacks, social attacks, and internal actors)]
- John: Risk is the resulting damage, harm, or loss of unmitigated vulnerability to threats [Probability x harm] [Why quantifying cyber risks is very difficult] [Quick examples (Import of unknown client data, perimeter attacks, social attacks, and internal actors)]
- Nik: What are some unique cybersecurity vulnerabilities and risks in e-discovery?
- John: [Overview of industry-related vulnerabilities]
- John: [Overview of industry-related risks]
- John: The e-discovery lifecycle has unique cybersecurity vulnerabilities to mitigate and it generates unique cybersecurity risks that should be considered
- Nik: While the audience is taking the poll, we’ll answer a question: In terms of security, do you have any tips for what to look when selecting a service provider? It looks like the audience is most concerned with [survey results here] John, what cybersecurity considerations should practitioners keep in mind in each stage of e-discovery? John: [Overview of cybersecurity considerations in the information governance, risk, and compliance stage]
- John: [Overview of cybersecurity considerations in the preservation, collection, and import stages]
- John: [Overview of cybersecurity considerations in the processing and analysis stages]
- John: [Overview of cybersecurity considerations in the review and production stages]
- Nik: While the audience is taking the poll, we’ll answer a question: How do you ensure metadata is preserved on infected files? The audience is leaning toward [survey results here] as the top driver in breaches. John, from your experience, what is the most common cause of cyber breaches? John: Ineffective leadership and culture [Overview of why this is the biggest driver and why compliance is not security] [Overview of contributing factors] [Importance of maintaining a good process in addition to selecting secure tools]
- Nik: In addition to building effective security leadership and culture, what should practitioners do to avoid these risks in e-discovery?
- John: [Overview of takeaways based on the current state of cybersecurity in e-discovery]
- John: [Overview of how Alvarez & Marsal is using Legal Hold in cybersecurity situations]
- Nik: If today’s viewers take five things away from today’s webinar, what should they be? John: [Closing thoughts] [When talking about seeking expert assistance, can you provide some high level tips about finding a provider that takes security seriously?]
- Nik: Thank you for joining us today. A survey will be available as you exit the webinar. Please take a minute to let us know your thoughts. We’ll use your feedback to improve future events. I also wanted to remind everyone that Relativity Fest 2018 will take place September 30 – October 3 in Chicago, and registration is now open. Join us to hear from more speakers like John. Visit relativityfest.com to learn more.