January 9, 2017
On December 27, 2016, the Department of Justice announced they had arrested a resident of Macau on charges of insider trading and hacking. Iat Hong, along with two other individuals, allegedly targeted several prominent New York law firms in a cyber attack and used the data collected from two successful breaches to engage in insider trading to the tune of $4 million.
In the New York Times article titled, “U.S. Charges Three Chinese Traders With Hacking Law Firms,” Sara Randazzo and Dave Michaels summarized the events as follows:
“Prosecutors said the traders won access to the deals by installing malware on firms’ computer networks, which allowed them to download information from email accounts. The defendants compromised the accounts of an information-technology employee at each law firm, and then posed as the employees to gain access to the firms’ private networks and email servers, according to prosecutors.”
This latest incident isn’t the first of it’s kind in recent months. In early 2016 an unauthorized third-party breached the email server at Mossack Fonseca, the firm at the center of the Panama Papers scandal, leaking millions of papers that contained confidential information to the general public.
As Preet Bharara, U.S. district attorney for New York, stated in a recent Department of Justice press release concerning the December 2016 breach,
“This case of cyber meets securities fraud should serve as a wake-up call for law firms around the world: You are and will be targets of cyber hacking, because you have information valuable to would-be criminals.”
Occurrences like the Panama Papers and this latest case highlight that law firms are increasingly targets for hackers because as Bharara stated, they have information that is valuable to criminals. And although the value of the sensitive and client-confidential data legal institutions store will not change, in our world of rapidly evolving business technologies, the way data is handled will.
Legal instructions face the difficult challenge of maintaining client confidentiality and protecting sensitive data while taking advantage of new technologies to stay current and competitive. The potential threat of damage to a firm’s clients and reputation is too great to ignore if IT security should fail. Email, in particular, is a critical application to secure because, as one of the main ways attorneys communicate with their clients, it’s a treasure trove of information that, without the right safeguards, is relatively easy to compromise by those with illicit intents.
During the past few months, we’ve covered several email security breaches on our blog. With this latest attack on these prominent New York City law firms falling on the heels of the latest Yahoo breach, it’s important that IT teams take practical steps to secure their environments to the best of their ability. However, a formidable defense isn’t built overnight and sometimes resources are limited.
TWO STEPS TO STRONGER DATA SECURITY
- Move sensitive applications and business processes to the cloud
Firms need to prioritize securing their most sensitive applications and data first. For most businesses, this will be email and document repositories.
Organizations who move to a solution like Microsoft Office 365 benefit from increased security overall in addition to flexibility and cost savings. Because providers like Microsoft have more resources focused on maintaining infrastructure and have a direct line into product development, they are often better positioned to deliver a secure infrastructure than an on-premises team.
However, outsourcing applications to a cloud provider is only the first step. Though cloud adoption improves an organization’s security posture overall, it can also create new challenges due to the ability of cloud service providers to access customer data.
- Maintain control over data with a Cloud Access Security Broker (CASB)
For some industries, including legal, moving sensitive applications and business processes to the cloud seems impossible because it can mean losing control over and visibility into confidential data.
Investing in a CASB provides organizations with an additional layer of security for cloud data. In addition to granular policy controls, cloud application privilege management, and audit logs, Vaultive also features industry-leading encryption for both structured and unstructured SaaS applications.
We also understand that protecting email without compromising user experience can be difficult. Because securing Exchange Online is often a priority for our customers we built a solution that protects unstructured data in Exchange Online at every potential point of cloud exposure for multiple protocols. Users can use their devices and email clients of choice, and IT teams benefit from compatibility with key administration and management functions, including eDiscovery and Microsoft Active Directory Federation Services.
The Vaultive CASB has helped many law firms embrace the benefits of the public cloud without compromising control over their company’s data.
Interested in learning more? Contact Multipath Data today