Cybercrime: protecting your firm Robert Loughlin, Executive Director, SRA Senior representative, National Cyber Security Centre Dr John Blythe, Cyber psychologist, University College London Dr Debra Malpass, Head of Research, SRA Dee Pang, Chief Information Security Officer, Slaughter and May

Today’s session Introduction to cybercrime Why cybercrime is a risk Type of reports received Behaviour aspects of cybercrime Cybercrime email trial results Quiz Panel discussion Summary

The solicitors and law firm market Across England and Wales we regulate: 10,400 Firms 750 ABS 185,000 Individuals ROBERT

Introduction to cybercrime Law firms targeted for money and/or information Attacks can threaten firms operations and/or reputation Widespread within the UK ROBERT

Cybercrimes and scams Hacking Email Modification CEO Fraud Malware Identity theft

Behavioural aspects of cybercrime What percentage of firms reported having some kind of information security incident in 2017? 30% 40% 50% 60% 70%

Results What percentage of firms reported having some kind of information security incident in 2017? 30% 40% 50% 60% 70% %

Behavioural aspects of cybercrime How many reports did the SRA receive regarding cybercrime in 2017? 157 1,570 15,700 157,000

Results How many reports did the SRA receive regarding cybercrime in 2017? % 157 1,570 15,700 157,000

Impact on the legal market 2017 2018 Jan - Mar Email modification fraud accounted for more than 70% of all cybercrime reports to us 157 £10.7m Email fraud reports to us risen by 25% since 2017 client money reported lost to cybercrime reports to us about cybercrime During the first quarter of 2018, email modification fraud accounted for more than 70% of all cybercrime reports And Email fraud reported to us had risen from 46% in 2017 to 71%.

Cybercrime Email Trial: Day of the week Key facts 7,295 firms involved C2,400 in each group 6 week trial period Over the six week period, people in the Wednesday and Friday groups received 1 email a week. The email was updated each week (to update a new case study), but the groups always received the same one Each of these groups was also halved again, where half of them received a control email (next slide) and the other half a ‘behavioural’ email (slide after)

Results Does the timing of the messages affect how firms engage with the communications?

You wouldn’t fall for this, but… Cybercrime email trial: Subject line Key facts 10k firms involved 3,300 in each group 3 month trial period – 3 end of month emails Help the SRA! Could you be next? You wouldn’t fall for this, but…

Initial results Does the tone of the messages affect how firms engage with the communications?

Behavioural aspects of cybercrime Who do you think should be responsible for cybercrime issues within your organisation? IT team Senior Management team Individual managers Everyone

Results Who do you think should be responsible for cybercrime issues within your organisation? IT team Senior Management team Individual managers Everyone %

Behavioural aspects of cybercrime Who is currently responsible for cybercrime issues within your organisation? IT team Senior Management team Individual managers Everyone

Results Who is currently responsible for cybercrime issues within your organisation? % IT team Senior Management team Individual managers Everyone

Behavioural aspects of cybercrime What do you think are the most important things that you/your firm can do to address cybercrime? Raise awareness Train staff Implement effective IT systems Implement better business processes (for example not allowing clients to change their bank details over the phone/email)

Results What do you think are the most important things that you/your firm can do to address cybercrime? Raise awareness Train staff Implement effective IT systems Implement better business processes (for example not allowing clients to change their bank details over the phone/email) %

Cybercrime Panel discussion Robert Loughlin, SRA (Chair) Senior representative, National Cyber Security Centre John Blythe, Cyber psychologist, University College London Debra Malpass, SRA Dee Pang, Slaughter and May

Over to you Questions? Comments/observations Any best practice to share?

Technology and legal services paper Thank you Find out more: Technology and legal services paper Risk Outlook IT Security paper Add AI/Innovation cover. Closing remarks Slides and video of today available on the website.. Please share with colleagues Talk to the team about risk outlook and grab a copy.. You also have a leaflet in your delegate packs directing you to risk outlook online Take a look at our paper on IT security and share it widely. Thank panellists and audience