narca presentation - it best practice
Post on 23-Jan-2017
115 Views
Preview:
TRANSCRIPT
Moderator: Mitch Hungerpiller, Mitchell-Wayne Technologies
Panelists:Mark Abendroth, Abendroth & Russell PC
Anna Alvarado, Couch, Conville & Blitt
Brenda Majewski, Kohn Law Firm S.C.
1.Where does your firm compare with information technology best practices?
2.What are those best practices that help you survive a security audit and satisfy audit exceptions for compliance?
3. What does it cost for all this security and best practice deployment and management?
4.Hear from our very experienced panel on successes and war stories to be better prepared to face your IT issues and audit within your budget!
IT Best Practices & Civil Procedure
• December 2006 Amendment of the Federal Rules of Civil Procedure (FRCPA) 34(a) and 34(b) cite retention policies of electronically stored information (“ESI”) used in the normal course of business for discovery in litigation.– This is driving the compliance audits – Comply with e-discovery required practices or pay
the piper– Deleted data NEVER goes away
IT Management Viewpoint
• Optimal Environment for Stable Systems are to NOT CHANGE them!– Compliance mandates that patches be applied
weekly for Microsoft OS’s– Compliance mandates that firmware be updated on
firewall’s within a reasonable period of time– Compliance mandates that policies be followed
whenever something changes– Compliance mandates all antivirus, antimalware and
content filters be updated & maintained daily
IT Professionals Do NOT Make Policy• IT professionals program, support and maintain
systems that automate tasks• IT professionals translate business policies and
program systems to comply with those policies• IT professionals carry numerous core
competences and skills similar to law, medicine, accounting and engineering
• Business Polices of Collection Law Firms and Agencies are created at the firm or agency level
IT Compliance Budget Busters
Network & Facility• Security
– email appliances, – network, – data at rest encryption– certificate maintenance– PCI Scans
• Change Control• File Integrity Monitoring• Voice & Video Recordings
Business Continuity• Image Based Backups vs. File• DR Restores Off Premise• Vaulting of Backups• Internet Bandwidth via Fiber
(Full Duplex)• Competent IT Professionals
Summary IT Compliance Best Practices
• Use Microsoft Group Policy to Manage Security• Automate as Much as Possible• Review Logs Daily• Maintain Renewal Dates for Annual Subscriptions• Use Managed Services when Possible• Include IT Professionals in Management Meetings• Budget for Technology Refreshes at HW Warranty
Expirations• Allocate Sufficient Resources for IT
• Password security enforcement – Cost = 0.• The 2014 most popular passwords remained
“password” and “123456” (specopssoft.com*) Change often.
• Helpdesk “cost” to reset passwords $25/user.*• Increase length and complexity, ie:
N@rc@2015! vs. Narca2015
Malware
Firewall
Virus protection
Employees - are they your weakest information technology link?Clicking on linksProhibit downloads
Permissible purpose documentation. Business resources.
Cellphones TCPA Scrubs Dialers
Next up wearable technology – policies and permissible purposes
Get SMARTSpecific – target a specific area for improvement.Measurable – quantify or at least suggest an indicator of progress.Assignable – specify who will do it.Realistic – state what results can realistically be achieved, given available resources.Time-related – specify when the result(s) can be achieved.
Issue: Employee desktop activity in the Firm's Accounting Room is not viewable via their Surveillance (CCTV) system. The camera view in this area is able to identify employees at their desks, but does not capture their payment posting activity.
PCI requirements – when two clients conflict
One client gives you one login
What does “/” mean - remove and disable or
remove or disable
Retain docs and SOPS that control the date of the action that occurred –Don’t retain only the newest SOP –
Call Recording Retention 13 monthsCalls: 3 months Call Auditing Forms: 12 months
• The American Bar Association’s Model Rules of Professional Conduct, adopted in whole or in part by all states except California, include Rule 1.6(c): “A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” (California’s is even tougher.)
General Best Practices…
• 3rd party vendor should be coupled with internal IT staff • IT professionals/vendors are your support system and
you should rely on them as subject matter experts• We hire IT professionals for a reason…SUPPORT,
GUIDANCE but most importantly EXPERTISE• Ask a lot of questions…most executives only have a
general/basic understanding of the IT world, it’s terms, the equipment, etc.
• Manage expectations of vendor with continuous and candid communication.
Best Practices
ommunication
• Monthly calls or at a minimum quarterly• Review written expectations…who, what, when, why and
how? • Ultimately IT Compliance is the firms responsibility
• Inspect server room, phone systems, internet, emails and camera's are functioning properly
• Ensure confirmation for server back up are received and logged daily
• Test locks on all secured doors• Test alarms for front, rear and server rooms• Make sure all logs are in place• Test internet usage for social media and/or other
prohibited sites
Helpful Tips:Daily/Weekly/Monthly Checklist
Law Firm Security Issues to ConsiderEncryption
Full Disc Encryption of laptops and other devices
BYOD Bring your own deviceWhose phone is it?Software for a remote “wipe”Never access a free hotspot at Starbucks
Law Firm Security Issues to ConsiderVendor Management
A lawyer should be mindful of the obligation to “act competently to safeguard information relating to the representation of a client against inadvertent or unauthorized disclosure…”
ABA Model Rule 1.6, comment 16
top related