Beyond the Fortress Fortify Your Content Before it Travels Beyond the Firm Walls

Paul Domnick, Board of Directors, Litéra Corporation Michael Fick, Consultant, Enlitened Technologies Joy Heath Rush, Vice President, Client Development (Law Firms), Litéra Corporation Our Panel

Clients demand protection of material under law firm control Lawyers have a duty to protect client data Law Firms are perceived as easy targets for bad guys Firms share sensitive information across security boundaries Framing the Issue

Law Firms as Cyber Targets Aggregate highly confidential information Most firms’ DM security is public by default Organized into client/matter folder structures Contain data from multiple organizations pertaining to one transaction/matter Perceived as less secure

ABA Model Rule Confidentiality of Information. Require lawyers to keep confidential ANY information relating to the representation of a client. ABA Model Rule 1.1 Comment 8 - Competency. To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology Ethical Responsibilities

Lawyers are communicators Lawyers access the most confidential information Lawyers work as part of a team – need to collaborate Lawyers work everywhere – sometimes in unsecured environments Lawyers are under severe client pressure Lawyers communicate with third parties creating content in motion Lawyers’ duty to protect and manage client information extends beyond the firm’s firewall Why Does the Practice of Law Create Business Situations that Could Compromise the Confidentiality of Client Information?

What are Firms Doing to Protect their Client Information and Electronic Communications? Source: A Study of the Legal Industry’s Information Security Assessment Practices, Sponsored by ILTA’s LegalSEC Team, August, 2013

General security of the firm’s IT Security of their data At rest/in motion Comingling Auditable defense Adherence to regulatory requirements Client Audits – Spotlighting Concerns “If you don’t understand what your clients expect of you, then you cannot invest in the appropriate level of protection and make informed decisions about risk.” Law Technology News – April 7, 2014

What Clients Expect Law Firms To Do

Protecting the infrastructure and the edge is critical, but what about the actual data … The General Approach Taken by the Industry – Protect The Infrastructure

How can the firm protect the future of the message beyond the initial transmission? Deal Rooms How can the firm control the file after it has been downloaded onto foreign network? Drop Box/iCloud How can the firm protect the client when content proliferates beyond the firm’s control? Mobile Devices How can the firm protect content on mobile devices, removable media and home PCs/Macs? Human Factor How can the firm protect against the busy lawyer that does not abide by firm security policies? Some Other Things to Consider When Protecting Client Data

Why Digital Rights Management (DRM) Protect what is ‘yours’ from misuse Misuse is accessing confidential information without authorization Enables proactive control over content Extends content custody beyond the perimeter Digital Rights Management – The Next Level of Threat Protection

What is the Security-Convenience Equation when Dealing with Content in Motion?

Secure File Transfer Integrated into No file size limits Available on mobile Send and receive files Full audit trail Secure Collaboration Full content control Simultaneous edits on a single document Side by side view of all changes Custody retained Full audit trail The Collaboration Landscape – One Size Does Not Fit All and Attachments Professional attachment management Reply all and BCC protection Secure File Synchronization 2-way exchange of shared folders No file size limits Granular security Full audit trail Frequency of interaction Confidentiality

Make it easy for lawyers to do the right thing.... Convenience breeds compliance Prioritize defenses based on the balance of risk involved Protect the content as well as the perimeter Booby-trap the data – Snapchat for documents Think of outbound risk as well as perimeter defense How Can Firms Begin to Fill the Gaps?

Share only what they want to share Share only with whom they want Share only when they want Share only how they want to share Imagine A World Where Lawyers...

From Michael: Despite continuous monitoring, robust defense and awareness of network activities the bad guys will get in. 1.Security is a team sport … educate users on how to play defense and support them with the right tools 2.Focus on controls to manage content and risk of data exfiltration 3.Know what is leaving the firm, protect it in motion and manage it when it lands outside the firm Three Take Aways...

From Paul 1.Habitual protection of content that is easy, mitigates risk 2.One size does not fit all 3.Building a fortress from infrastructure up is essential but not enough. You must also build from the people and the content down Three Take Aways...

Thank You!