the SOCIETY RECORD - Nova Scotia Barristers' Society

LIANS
TIPS FROM THE RISK AND PRACTICE MANAGEMENT PROGRAM
Electronic data protection
BY STACEY GERRARD
LIANS Counsel
Many of us have a healthy
skepticism about flying
in “the Cloud”. We worry
about our client information being
compromised and tend to keep
our data stored a little closer to
home. So imagine arriving to work
one day, turning on your computer
and instead of accessing your
client files, a digital ransom note
appears: “If you pay our ransom
demands, we will restore access
to your computer.” This scenario
may sound farfetched but it’s what
a law firm in Alberta recently encountered.
Its lawyers were the victims of a “ransomware” attack in
which hackers burrowed deeply into their computer network, infiltrating
and encrypting their electronic records. No cloud required.
This kind of attack on your system can be mitigated by ensuring
your system has up-to-date antivirus software and anti-spyware
software. Ensure that you install the updates and patches released
by the software manufacturer. Back up your data regularly and store
that backup off-site to minimize the harm of blocked access. Get a
good firewall in place or use a network security gateway. If you don’t
know how to do all of this yourself, talk to a computer professional
about these and other recommendations for your system.
LIANS has reported at various times about email users (Yahoo!
Mail and others) having their accounts compromised after a
hacker retrieved passwords from the cookies stored in computer
browsers. Hackers use this access to forward an email containing a
malicious link to the yahoo account’s address book contacts.
This kind of attack can be avoided by using a strong password and
changing your password on a regular basis. A “strong” password
is 12 to 15 characters in length and contains a number, a special
character and a capital letter. You might try using a song phrase
or motto. According to Splashdata, the most vulnerable (weakest)
passwords are: password, 123456; 12345678; abc123; qwerty;
monkey; letmein; dragon; 11111; and baseball.
Online hackers have also threatened lawyers’ bank accounts. You
should ensure that your trust account is “read only” internet
access. Regular monitoring of your accounts will alert you to suspicious
transactions. In Manitoba, a hacker gained access to a law firm’s
general account, set up an automatic transfer of $5,000 to another
bank and then transferred money to a prepaid credit card. They did the
same thing the following day. Because the accounts were monitored
regularly, the firm’s bookkeeper caught the transactions on the second
day. The firm then froze the online access, changed its password and
reported the incident to the bank and the RCMP.
As these examples demonstrate, data protection – whether it is your
firm’s data or your clients’ – is becoming a much higher priority
for lawyers and law firms. Data loss can be as simple as losing a
document that took you hours to create, or as catastrophic as losing
all data due to a virus or a server crash. A hacker can not only cause
you to lose data, but can damage your reputation as well.
Here are the top 10 ways you can protect your data and prevent this
from happening to you:
1. Maintain physical security: lock your office door, file room
and your server doors when you leave at night, or lock away
sensitive information if you have afterhours cleaning staff. If you
have a laptop, either bring it with you at the end of day or lock
it away. Avoid putting printers and fax machines in high-traffic
areas – consider putting them in your file room or another room
with a locked door.
2. Maintain virtual security: password protect your laptop and
smartphone. This way if you leave your device behind in a
washroom or taxi, you won’t have the added worry of someone
accessing your private information. To password protect your
laptop: to go the start menu > control panel > User Accounts >
create password. On your smartphone, go to settings or options
> security > Screen lock (exact words may vary).
3. Protect your computer by using an operating system that
requires users to be “authenticated”. This can restrict what
individual users can see and do on the computer.
4. Use strong passwords and change them regularly.
5. Back it up: back up your data, and test your backups
regularly. Make sure to back up your email as well.
6. Keep a copy of your data offsite: if you’re not ready to store
information in the Cloud, you can use an external hard drive for
data backup. They are portable, inexpensive, and can store a
large volume of data. In fact, buy two.
36
The Society Record