Cleveland computer firms The T1 Company and the Accellis Technology Group combined to present a lunchtime seminar on current cybersecurity topics at the Cleveland Metropolitan Bar Association on June 10.
Although most of the attendees were law office technical support, the tenor of the presentation by Accellis founder Joseph Marquette was a completely clear-eyed, user-based view of the entirety of the field—from monitoring firewalls to the psychology of hackers.
One attendee, Sam Vongratana, said that he had, “seen more (useful information) than in many other, sales-based seminars.” Vongratana is the software facilitator integration specialist for the Canton-based law firm Krugliak, Wilkins, Griffiths & Dougherty Co., LPA, and said that he spends a lot of time on this kind of basic and advanced research into law firm computer security.
The T1 Company, which sponsored the event, is a high level internet access company with a variety of services. Accellis is one of Cleveland’s leading legal technology consulting and solutions companies.
All computer security briefings are designed to scare, but this presentation was given with the background of ongoing disclosure of the enormous recent government security leak, as well as the recent hacks of Target and other retailers, so it was particularly pointed.
The seminar proceeded in a rapid and highly detailed fashion. Here are some of the highlights.
Marquette began the seminar by stating the obvious, that, “cybersecurity has been an issue for a long, long time, and, in the last four or five years, it has become an issue in the legal industry—not just in the United States, but around the world.”
Law firm computer systems are under attack, he said, because they contain data that criminals can find useful. Lawyers, he said, are in many cases not giving adequate value to the data that they have stored on their computer systems, and so many of them, particularly in the larger firms, and to his endless frustration, do not recognize a potential problem.
“The kind of confidential information that cyber criminals trade in is exactly the information that law firms have in their databases,” he said.
But that fact is easy to miss because, he said, “the firm itself may not be the primary target.” Many cyberattacks use a computer network to launch other attacks. The sophistication of the new breed of cybercriminals makes it difficult to determine who is attacking whom, and why.
For instance, the Target attack that stole thousands of people’s credit card information used a vulnerability in the computer system of a plumbing company that did contract work for Target.
Likewise, and vendor that has access to any part of a law firm’s system can create the vulnerability that can open the system up to a hacker or thief. The client file data itself may not be useful to a thief, but that information may lead to other information that could be of use.
“As an industry,” Marquette said, “we make a very easy target.” For the last two years, he said, the primary means of attacking computer systems has been “phishing,” an attack that has any employee letting a criminal into a system by clicking on any link in a phishing email.” This is a training problem, he said.
The solution here is to employ a fully-monitored computer security system, a solution that can be more of an expense than many firm partners want to engage.
But cybercriminals these days can create a lot more problems than just accessing data, said Marquette, who described a new form of attack on computer systems, including the systems of law firms, that can be the most damaging attack yet seen.
Called the “Dyer Wolf,” this attack combines every form of phishing, fake websites, viruses, denial of service attacks, and seemingly every other cybercriminal action into one huge systematic invasion across multiple platforms, databases, and continents.
Dyer Wolf works when someone (a lawyer or support person) clicks on a bogus phishing link. The link does nothing noticeable at the time, but it loads malware onto the system. At a later date, the malware is executed in two phases, eventually generating a look-alike bank website. The fake bank website tells you to call a phony phone number, you give your log-in information to the person on the other end of the call, and the phisher is in the bank account to the tune of $1.5 million. The firm’s system is then immediately subject to a denial of service attack, keeping it from tracking the theft. The money stolen cannot be traced, and it is gone. All from a simple mistake of clicking on an unknown link in an email.
Vongratana was particularly impressed by the Dyer Wolf presentation, saying that, “it definitely gave me something to present to the lawyers in my firm.”
This article is reprinted with permission from The Akron Legal News.
Published: June 19, 2015