©2022 SecureLink. All rights reserved.
Given the valuable nature of law firm data – confidential and sensitive client information – it’s no wonder that the number of cyberattacks on law firms has increased over the past few years, with ransomware as one of the most common methods of attack. Correspondingly, there’s been a heightened need to implement legal cybersecurity solutions to enhance law firm data security. Clients are particularly concerned about the privacy and security of their legal information and are pushing law firms to demonstrate that they’ve taken proactive measures to keep their data and information secure – particularly when it comes to any third parties who may have access to their data. However, with a third of law firms experiencing a security incident in 2020 alone, effectively securing law firm data from unauthorized access or attacks continues to be a struggle.
Why is this the case? Where are these cyber threats to law firms coming from? One of the easiest and most common attack vectors cybercriminals use is targeting and compromising vendors and third parties who are working with law firms. And the data shows that hackers are right on target: Nearly two-thirds of data breaches originate through third parties. So although these third parties provide valuable services and support law firm operations, they have also become one of the primary cybersecurity risks faced by law firms with the remote access they have.
Take the example of the recent Jones Day law firm data breach in early 2021, where confidential and sensitive client data was exposed and posted online. How? Through one compromised third party. This incident showcases the risks third parties and their remote access can present and drives home the importance of third-party risk management as part of a law firm’s cybersecurity strategy. Securing third parties’ access to law firm data, systems and networks has never been more important. The consequences of failing to do so are high, with exposure of confidential client data, reputational damage, and loss of future business – to name a few – on the line.
In today’s environment of frequent law firm cyber attacks, it is only a matter of when, not if, an attacker sets its sight on your network, likely through your third parties. Today is the day to protect your client’s information and data from the third-party perspective by securing your third parties’ remote access to your network and systems.
Checklist
Learn how you can eliminate the third-party vulnerabilities that threaten the security of your network and data with SecureLink. Count on the granular controls and audit features you need to fully secure your third-party remote access and meet the legal industry’s cybersecurity best practices, as well as your clients’ security requirements.
| Detailed audit and reporting | Capture all third party session activity with HD video and keystroke logs, as well as session details, including files transferred, commands entered, services accessed and work completed |
| Multi-factor authentication tied to individual accounts | Ensure approved third-party access with individual accounts for each user, verifying identities with multi-factor authentication and current employment status upon each login |
| Native credential vault or integration with your PAM | Store credentials securely and inject them directly into a session, ensuring third parties have zero visibility and access to network or application credentials |
| Granular access controls | Define allowed access down to the host and port level with set access timeframes, and assign granular permissions to each user to ensure least-privilege access |
| Compliance and security best practices configuration checklist | Use the built-in checklist to ensure your SecureLink server is configured to meet your compliance requirements, as well as to meet recommended law firm cybersecurity best practices |
| Documented access and approval workflows | Define required access approval workflows for each application, with documentation of restrictions and approvals in place |
| Self-registration and automatic de-provisioning | Allow third-parties to register for their own user account, and send the approval request directly to the business owner, without needing IT involvement for account creation
Define timelines or rules for when accounts should automatically be de-provisioned to remove access |
| Universal access methods | Support connectivity and audit for all TCP and UDP protocols, including, but not limited to, RDP, SSH, Telnet, HTTP(S), FTP, and custom protocols
Allow vendors to use their own native tools in providing support |
| Access review | Receive notifications upon vendor’s connection and disconnection from your network with links to quickly and easily review completed work |
© 2022 SecureLink. All Rights Reserved | Privacy Policy | License Agreement | Security Disclosure
