The UK’s National Cyber Security Centre (NCSC) is urging firms in the legal sector to improve their defence against cyber-attacks. With recent increases in cyber-attacks, law firms are increasingly becoming attractive targets for cybercriminals due to the abundance of sensitive data, such as financial details, personal information and intellectual property. Additionally, the recent and widespread adoption of hybrid working models has increased the attack surface for legal firms.

The NCSC has published a new report, Cyber Threat to the Legal Sector, which highlights numerous ways in which law firms are being targeted by cyber criminals. The report covers a range of areas where solicitors and other legal services have been vulnerable to cyber attacks, including:

• Ransomware attacks: Where ransomware, a type of malware that encrypts a victim’s files and demands a ransom payment in exchange for the decryption key, is placed on firms’ systems. Legal firms are particularly vulnerable to ransomware attacks due to the nature of the information they handle.
• Phishing attacks: Fake emails or text messages that appear to be from a legitimate source, such as a bank or credit card company, are common in “phishing attacks”. The emails or text messages often contain a link or attachment that, when clicked, installs malware on the victim’s computer.
• Data breaches: When sensitive data is stolen from a computer system, that’s a data breach. Legal firms are at particular risk of data breaches because of the nature of the data they handle, plus the fact that law firms are seen as being wealthy due to the high hourly rates charged for their expertise.
• Password attacks: One key weakness in many firms’ IT systems is poor password hygiene, with easy-to-guess, overly simple, and re-used passwords allowing threat actors to breach systems and access sensitive information.
• Supply Chain Attack: Even if your own firm is as secure as it can be, there may be weaker links elsewhere in your supply chains. These are the attack vectors where cyber criminals can “piggyback” a trusted service connected to your firm and exploit their weaknesses to then access your systems.

The NCSC’s cyber threat report also highlights how legal firms can improve their IT support, including:

• Implementing a strong password policy: Employees should use strong passwords that are unique for each account. Passwords should be at least 12 characters long and contain a mix of uppercase and lowercase letters, numbers, and symbols.
• Keeping software up to date: Software updates often include security patches that can help to protect against known vulnerabilities. Legal firms should install software updates as soon as they become available.
• Using a firewall: A firewall can help to protect a computer system from unauthorised access. Legal firms should use a firewall that is configured to block unauthorised traffic.
• Backing up data: Law firms should regularly back up their data. This will help to protect against data loss in the event of a cyberattack.

The NCSC report also provides valuable guidance on how legal firms can improve their cyber security and IT support. By following the recommendations, legal firms can help to protect themselves from cyberattacks. 

In addition to the guidance provided by the NCSC, legal firms can also take the following steps to improve their cyber security:

• Educate employees about cyber security risks: Employees should be aware of the latest cyber security threats and how to protect themselves. Law firms should provide employees with training on cyber security best practices.
• Have a plan for responding to cyberattacks: In the event of a cyberattack, legal firms should have a plan for responding to the incident. This plan should include steps for containing the attack, restoring data, and notifying affected parties.
• Get help from a cyber security expert: If your firm is concerned about its cyber security, you can get help from a cyber security expert. ITSD’s cyber security team can assess your organisation’s cyber security posture, recommend steps for improvement, and put processes and procedures in place to protect your business.

Good cyber security is essential for businesses of all sizes, and the UK’s law firms are in particular focus due to the sensitive nature of the legal sector.

Auditing your business’ IT systems and securing your organisation against computer-based threats is a specialisation of ITSD’s and our team of seasoned cyber security experts are available to assist with your requirements.