Securing the Law Firm Myth vs. Reality vs. Practicality: Reconciling standards and regulation with the business critical processes of a global Law Firm Tim Collinson Information Security Manager

Disaster!

Challenge to reconcile Myth, Reality & Practicality Regulation Standards Reality Move to 'Martini' Lawyers Mobile and Flexible (time, location, device) Threats - Intentional & Accidental Practicality Flexibility vs. Confidentiality Security is great unless…. Staying close to Risk & Compliance

Addressing the challenge Current situation Mobility, portability, cloud Confidentiality & sensitivity Client expectation Product proliferation Making Progress Aligning to Firm's Strategy Ethos change: Security not just part of IT Information Security Programme

Information Security Programme Message to Clients To demonstrate we are properly managing an increasingly complex and critical area of risk. Message to Partners Assurance that our security needs are being met in line with best practice. Message to the Firm Process for agreed change in the context of proper governance.

"agreed change in the context of proper governance" Securing the Law Firm "agreed change in the context of proper governance"

Behavioural change Risk Appetite Always some risk Firm makes decision on handling risk Software Policy Taking Responsibility Individuals taking responsibility for their actions Awareness training Encrypted USB stick ?

10 Tips… Senior Management Speak their language Being an Enabler e.g. policy wording Risk Based Approach Asset Management Know what's out there Audit Logging and alerting

…10 Tips User & Admin Accounts Malware Defence Data Recovery Assessment Patching Penetration Testing Cyber Incident Management Plan for when, not if… Breaches have to be recorded

What would you do?

Thank you Tim.Collinson@twobirds.com Bird & Bird LLP is a limited liability partnership, registered in England and Wales with registered number 0C340318 and is authorised and regulated by the Solicitors Regulation Authority. Its registered office and principal place of business is at 15 Fetter Lane, London EC4A 1JP. Bird & Bird is an international legal practice comprising Bird & Bird LLP and its affiliated and associated businesses and has offices in the locations listed on our web site: twobirds.com. The word “partner” is used to refer to a member of Bird & Bird LLP or an employee or consultant, or to a partner, member, director, employee or consultant in any of its affiliated and associated businesses, who is a lawyer with equivalent standing and qualifications. A list of members of Bird & Bird LLP, and of any non-members who are designated as partners and of their respective professional qualifications, is open to inspection at the above address. twobirds.com