beyond the fortress fortify your content before it travels beyond the firm walls

Beyond the Fortress

Fortify Your Content Before it Travels Beyond the Firm Walls

• Paul Domnick, Board of Directors, Litéra Corporation

• Michael Fick, Consultant, Enlitened Technologies

• Joy Heath Rush, Vice President, Client Development (Law Firms), Litéra Corporation

Our Panel

Clients demand

protection of material under law

firm control

Lawyers have a duty to protect client data

Law Firms are

perceived as easy

targets for bad guys

Firms share sensitive

information across

security boundaries

Framing the Issue

Law Firms as Cyber Targets

• Aggregate highly confidential information

• Most firms’ DM security is public by default

• Organized into client/matter folder structures

• Contain data from multiple organizations pertaining to one transaction/matter

• Perceived as less secure

• ABA Model Rule 1.6 - Confidentiality of Information. Require lawyers to keep confidential ANY information relating to the representation of a client.

• ABA Model Rule 1.1 Comment 8 - Competency. To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology

Ethical Responsibilities

• Lawyers are communicators• Lawyers access the most confidential information• Lawyers work as part of a team – need to collaborate• Lawyers work everywhere – sometimes in unsecured

environments• Lawyers are under severe client pressure• Lawyers communicate with third parties creating

content in motion• Lawyers’ duty to protect and manage client information

extends beyond the firm’s firewall

Why Does the Practice of Law Create Business Situations that Could

Compromise the Confidentiality of Client Information?

What are Firms Doing to Protect their Client Information and Electronic Communications?

Source: A Study of the Legal Industry’s Information Security Assessment Practices, Sponsored by ILTA’s LegalSEC Team, August, 2013

• General security of the firm’s IT• Security of their data• At rest/in motion

• Comingling • Auditable defense • Adherence to regulatory requirements

Client Audits – Spotlighting Concerns

“If you don’t understand what your clients expect of you, then you cannot invest in the appropriate level of protection and make informed decisions about risk.”Law Technology News – April 7, 2014

What Clients Expect Law Firms To Do

Protecting the infrastructure and the edge is critical, but what about the actual data …

The General Approach Taken by the Industry – Protect The Infrastructure

• EmailHow can the firm protect the future of the email message beyond the initial transmission?

• Deal RoomsHow can the firm control the file after it has been downloaded onto foreign network?

• Drop Box/iCloudHow can the firm protect the client when content proliferates beyond the firm’s control?

• Mobile DevicesHow can the firm protect content on mobile devices, removable media and home PCs/Macs?

• Human FactorHow can the firm protect against the busy lawyer that does not abide by firm security policies?

Some Other Things to Consider When Protecting Client Data

•  Why Digital Rights Management (DRM) • Protect what is ‘yours’ from misuse• Misuse is accessing confidential information

without authorization• Enables proactive control over content• Extends content custody beyond the perimeter

Digital Rights Management – The Next Level of Threat Protection

What is the Security-Convenience Equation when Dealing with Content in Motion?

Secure File Transfer• Integrated into email• No file size limits• Available on mobile• Send and receive files• Full audit trail

Secure Collaboration• Full content control• Simultaneous edits on a single document• Side by side view of all changes• Custody retained• Full audit trail

The Collaboration Landscape – One Size Does Not Fit All

Email and Attachments• Professional

attachment management

• Reply all and BCC protection

Secure File Synchronization• 2-way exchange of shared

folders• No file size limits• Granular security• Full audit trailFrequency of interaction

Confidenti

alit

y

• Make it easy for lawyers to do the right thing.... Convenience breeds compliance

• Prioritize defenses based on the balance of risk involved

• Protect the content as well as the perimeter• Booby-trap the data – Snapchat for

documents• Think of outbound risk as well as perimeter

defense

How Can Firms Begin to Fill the Gaps?

Share only what they want to share

Share only with whom they want

Share only when they

want

Share only how they want to share

Imagine A World Where Lawyers...

From Michael:Despite continuous monitoring, robust defense and awareness of network activities the bad guys will get in. 1. Security is a team sport … educate users on how to

play defense and support them with the right tools 2. Focus on controls to manage content and risk of

data exfiltration3. Know what is leaving the firm, protect it in motion

and manage it when it lands outside the firm

Three Take Aways...

From Paul

1. Habitual protection of content that is easy, mitigates risk

2. One size does not fit all 3. Building a fortress from infrastructure up is

essential but not enough. You must also build from the people and the content down

Three Take Aways...

Thank You!