Director Nightmare #2: Cybersecurity


May 31, 2013

It’s no wonder cybersecurity is the #2 issue that keeps corporate directors up at night. The news abounds with stories about Chinese cyber espionage, overzealous Department of Justice probes, multi-million dollar ATM thefts, crippling denial of service attacks and leaks from social media and “rogue” employees. In some respects the public is numb to all this (unless that was your credit card number that was broadcast). But directors are and should be worried. The Internet can be a risky place.

The threats may seem overwhelming. How can a company avoid the global spread of malware? Don’t the Patriot Act and FISA allow the feds access to a company’s records without its knowledge anyway? Won’t overseas companies copy your products somehow no matter what? What is Twitter about?

The reality is that cyber risks can be thwarted and mitigated with good security risk management programs and IP protection programs. These programs aren’t just about having the latest technology. Proper use of technology and company data by people is the key. In fact, employees, not bad technology, are the source of 56% of data breaches, according to a hospital survey. Breathe: employees are trainable.

Changes in technology are a factor, however. The cloud, smartphones and social media are new avenues for company data delivery, access and storage. A company’s internal IT security protocols are important but becoming less relevant as more data moves to the cloud. Yet, another survey showed that only 50% of company IT security professionals reviewed the security practices of the cloud and SaaS providers that their company uses. Like employees, cloud providers have varying levels of sophistication and attention to data security. That’s a lot of unassessed risk.

Next, more employees use their own smartphones and tablets to access the company systems, creating zillions of copies of company data on uncontrolled devices. Well, uncontrolled at 76% of companies’ since only 24% report having BYOD (bring your own device) policies. Even company issued devices don’t necessarily come with security guidelines.

Social media, meaning Facebook, Twitter, Pinterest and the like, are the electronic versions of newspapers and press releases – except that they are used by lots of employees, reach many more people and are instantaneous. Directors who are used to all company statements being carefully crafted through the PR department may find their company’s use of social media frightening. And, if the company doesn’t have a policy for social media use, it may be at risk for leaks about company strategies or misinformation about products, not to mention embarrassments like photos of drunken staff parties. Social media is a very easy way for employees and customers to spread information which represents the company. It is a great marketing and advertising tool but needs management to avoid damaging a company’s brand or worse.

Net, if a company’s internet use or email policies were written in the nineties, it’s time to give them a fresh look. And policies alone don’t fix things. A full compliance program which includes education, auditing and enforcement is required.

Ultimately all cyberthreats cannot be prevented. Directors sleep better if they know the company is prepared to manage a data security breach. While 63% of the directors surveyed felt comfortable that their company could manage a data security breach, they weren’t so happy with their companies’ crisis management plans. Those plans encompass such catastrophes as cyberattacks and natural disasters that shut down operations and corporate disgraces like tainted products, oil spills or executive fraud. 57% of board members said that they had reviewed their company’s crisis management plan within the last year, but only 34% said that they were very comfortable with the plan. 30% said they were not at all comfortable with the plan, the company had no plan, or they didn’t know if the company had a plan.

Corporate boards aren’t responsible for the day to day risk management of the company. But, when they hear about the cyber theft and cyber crises around the globe, they must know their company is prepared. A modern data security program, IP protection program and crisis management plan can significantly reduce threats from lazy or malicious employees, unsafe devices and rogue cloud installations.

Directors should be leading the charge when it comes to acknowledging cybersecurity.  Regardless of their technical backgrounds, Directors should be asking the right questions of their leadership to ensure key company threats are addressed.  If the company isn’t able to address these issues internally then it needs to bring in resources to take an objective look and implement best practices in the industry.  Proactive risk management should result in a boring outcome, meaning, there are no cybersecurity crises.  It definitely beats the alternative.

The Cloud, Security and Legal Ethics – Whom Can I Trust?

April 12, 2012

As I’ve been looking into the issues around lawyers putting client data in the cloud, I’ve run into a fair amount of (quasi?) scholarly work on the issue. There are several organizations that have published advice on the subject, including  ILTSO, ILTA and ISACA. The primary source materials come from the ABA and various state bar Ethics Committees. So far, case law is very limited, dealing more with maintaining the attorney-client privilege with email and the discoverability of client data that someone else put in the cloud. Your malpractice insurance provider may have something to say about it. And then law practice management vendors publish “White Papers” that describe why their product is a great solution for your practice.

It’s a lot of fairly complex data and it doesn’t all agree. I’ve written a couple of articles for local Colorado legal publications on how the Ethics Committees are approaching the issue. But, so far their advice has been vague and unrealistic. Clearly the users of the many law practice management systems out there (not to mention gmail, Dropbox or Docs to Go users) haven’t been paying attention to them. And until one of them has a big security breach and clients start grieving, no one will – which doesn’t mean lawyers shouldn’t care what the Ethics Committees think. It’s just that the committees aren’t very helpful for lawyers trying to make an educated decision, or use “reasonable precautions” as the opinions require.

I’ve found that some of the organizations give more practical advice. But, the reader still needs to appreciate who is involved in giving that advice. ILTA, the International Legal Technology Association, has some informative publications. It’s important to know, however, that they are provided or sponsored by the vendors of the services they are evaluating. It’s a trade organization, or as it describes itself, a ‘networking organization’.

In contrast, ILTSO, the International Legal Technical Standards Organization, has some of the same membership as the ILTA, but is focused on providing lawyers with standards that they can use to self assess their security compliance. Their standards for client data security are specific and clear, if perhaps beyond what most lawyers are doing today.

ISACA, the Information Systems Audit and Control Association, has a broader audience than just the legal profession. And think about it, other types of businesses, including health care and financial services, have many more technical security requirements to follow than lawyers. It is an independent organization that provides certification in auditing and security. ISACA has issued guidelines on adopting cloud use that lawyers can apply to the business of practicing law which shed light on the risks and rewards of this advanced technology.

Finally, a few words about white papers. The purpose of a white paper is to help you make a decision, so the author is important. They are rarely impartial. A commercial white paper is written to persuade you to choose that vendor’s product. They aren’t false, or they would be prohibited by the FTC rules on false advertising. But they are marketing materials. Think of it like a brief. It may cite cases and ethics opinions. It may also conveniently ignore various issues. Trade associations and standards organizations also have agendas. To the extent their white papers help prod vendors and users towards better practices, I trust them more. If ethics committees considered the advice of the standards organizations when they issue their opinions (and maybe they did, but it’s not apparent), they would be more practical and helpful.

Working and Playing in the Cloud – A Review of What’s Cool, Useful and Scary Up There

March 28, 2012

Tech Issues for  Lawyers, Non-Techies and Others Who Like Their Privacy

Have you soared into the cloud? Chances are you have tried this advanced technology, whether for work or personal use. The cloud, as the term is used today, has been around for general consumption since the mid 90s – were you an early yahoo or hotmail email account user? Today, the cloud refers to anything that involves delivering hosted service over the Internet. This can include a myriad of common computer services, like email, document and photo storage, computer backup and also more specialized, work-based systems for financials, sales, law practice management, employee performance management, expense management and customer service. If you need an Internet connection to get to it, it’s most likely in the cloud.

I’m a lawyer. Many of my colleagues have barely gotten to the email age, while others have virtual practices taking advantage of many of these services. The purpose of this blog is to help lawyers and other privacy-minded individuals without technical backgrounds understand what it means to put their documents, their business, their personal lives and their trust in the cloud.

While email has been a part of life for long enough now that most people understand it, the other cloud based systems are new enough that many people don’t know anything about how they work.  One type of cloud service that is appealing to lawyers is free – or cheap – document storage. Introduced only in the last few years, there’s Google Docs (2010), iCloud (2011), Dropbox (2007), Amazon Cloud Drive (2011), SugarSync (2006), SkyDrive (2007) and Mozy (2006), just to name a few.  They all provide a certain amount of storage for free and allow access to your documents anywhere you can catch a WiFi connection. They are very attractive for solo practitioners of any profession, small businesses trying to avoid building their own network, students, travelers, you name it. They all work pretty well too, although some have more features than others. But are they a good solution for you?

As lawyers, we have ethical requirements to keep our clients’ information confidential and to preserve the attorney-client privilege. Our governing bodies are struggling with giving guidance on whether any cloud based service satisfies ethical requirements. In contrast, the medical and financial fields are way ahead of us in dictating appropriate use of electronic media. HIPAA and HITECH proscribe many rules regarding storage and security of protected patient information. Financial services are subject to a complex array of legal, regulatory, interchange and payment processing rules governing electronic financial data. Somehow lawyers have resisted regulation here – but is that a blessing or a curse?

The guidance from the ABA and various state Ethics Committees is vague and impractical. They give an initial thumbs up to the cloud but then expect a relationship with a vendor that doesn’t exist (like unlimited liability and guaranteed confidentiality). There are some practical issues too. A simple review of the terms for these omnipresent document storage offerings reveals some flaws. The providers:

  • don’t promise to keep your data confidential;
  • don’t promise reliability;
  • can shut you off at any time;
  • can discontinue the service at any time;
  • can change their terms of service at any time;
  • may send your data anywhere in the world they have a server; and
  • may disclose your data without your knowledge to third parties because they deem it necessary

If you were my client, would you want your confidential information there?

But not all cloud offerings are alike. There are other cloud offerings that meet higher security standards and which can be used by even medical and financial professions. Lawyers have more targeted cloud offerings too, including Clio, Citrix, Law Loop, Livia, Lextranet, MyCase, Nextpoint, and Rocket Matter. Their websites will tell you not to be afraid of the cloud, but will they guarantee it? That’s a topic for future posts.