By Joseph Raczynski

The 5th Annual Law Firm CFO/CIO/COO Forum

In eerie silence, law firms could be easily breached like JPMorgan Chase, Home Depot and Sony by cyber criminals.  The difference with law firms, few would know the sensitive data was absconded.  While law firms do not have to report such penetrations we learned at the Data Privacy, Security & the Globalized Law Firm CFO/CIO/COO Forum that they must increasingly stay vigilant to avoid such a plight.

In the first panel discussion of the day with Mike Marsilio, Director of Security and Compliance, DTI; Mark Connelly, CISO Thomson Reuters; Steve Katz, Board member Glasswall Solutions; John Masserini, CSO, The MIAX Exchange; Mark Olson, VP and CISO, Iron Mountain, they focused on a few key data security topics.

What keeps them up at night?

John Masserini expressed several concerns which were mutually shared by the panel.  Simply put, employees create significant anxiety.  What are they downloading?  What links are they clicking?  Are they using dirty unencrypted jump drives on their computers?  All were in agreement that internal employee’s actions can cause the most harm to a network.

Other concerns expressed:

• Regulatory requirements
• Not having enough skilled people
• Complexity of vendors systems and vendors who are not mindful of the security concerns

Answering some of these issues Mark Olson of Iron Mountain offered a few suggestions.  There has to be processes in place.  Enact physical requirements on your data rooms, e.g. isolating buildings and spaces.  In addition have vendors escorted into your buildings.  Knowing that you have to trust some vendors, log absolutely everything.  Do not allow jump drives unless cleansed by your security professionals.  Ultimately the mantra of the day was educate, test, create and follow process and procedure and retrain constantly to guard against breaches.

How do you speak with the partnership about security?

The panel discussion also touched how best to convey the magnitude of security and risk with the firm partnership.  One distinction they made was that the Chief Information Security Officer (CISO) must show that their investment in IT is directly related to retention and new business.  If there was a breach the harm to the brand could be irreparable.  When explaining security they suggested staying away from tech talk and painting a picture that non-technical people could understand.  Partnership tends to lean-in regarding financial discussions from the CISO.  When they do IT should state it in a fashion that “they know you know” the business is about making money.  The concept driven home was that security and risk is not a cost center rather a retention and new business play.

As the panel closed the session they emphasized that law firms are in a precarious position.  They are brokers of sensitive and important information (think IP and merger information), and to that end they are a massive target.  It is the responsibility of the Chief Information Security Officer (CISO) to put in place process, procedure and pound the drum for employee education and awareness.  The unseen enemy is really those employees that are uneducated, unaware, and unwilling to properly care for the firm’s tools and technology; thus exposing the firm to the outside attacks.