Handling some of their clients’ most confidential client data, Australian legal services firms are high-value targets for cyber-attackers. Cyber threats are increasing, as highlighted by findings from the 2022-23 financial year from the Australian Cyber Security Centre (ACSC), which reported that a cyber-attack occurred every six minutes, up from every eight minutes the previous year. It is now imperative legal professionals prioritise their firm’s cyber security to safeguard sensitive data and maintain client trust.
That’s why we’ve put together this essential guide—to help legal practices navigate the complexities of cyber security, understand their responsibilities, and implement strategies to mitigate the known and hidden costs of a breach.
Source: ACSC
The True Costs of Cyber Incidents
While much of the focus around cyber incidents is honed in on regulatory compliance and the technical aspects of data protection, the true costs of a cyber breach extend much further. These costs can be grouped into several categories, each representing different levels of impact:
- Direct Financial Costs: These include immediate, visible costs such as recovering lost assets, paying ransom demands, and dealing with fraud. Direct financial costs are often just the beginning of a much deeper impact on the organisation.
- Reputational Damages: Reputational damage may be long-lasting and have severe consequences for the business. Inevitably, it is tough to get back client trust and loyalty; hence, reputational damage severely affects a company’s potential to win and retain new business. According to recent findings from Encore.io, 41% of Chief Information Security Officers (CISOs) and C-level executives named reputational damage as one of the highest costs after a cyber-attack, while 34% agreed that the loss of clientele had a significant impact.
- Attrition Costs: Cyber incidents can also affect employee retention. Encore’s research revealed that more than half of surveyed office workers (54%) would reconsider working with a company that experienced a recent cyber breach. This suggests that breaches affect current staff retention and complicate future recruitment efforts. Keeping employees in the dark about breaches can further erode trust.
Understanding associated costs underlines the importance of an effective cyber security posture that meets regulatory requirements while being cognizant of the wider implications of any prospective cyber incidents. Investing in preventative measures and maintaining transparency with clients and employees in the event of a breach is an important tenet of a resilient cyber security strategy.
Current Cyber Threats for Law Firms
Australian law firms are increasingly becoming targets for cybercrime, often due to the confidential and valuable information they handle. From client records to financial data, the information housed within a law firm’s IT infrastructure is a lucrative target for attackers. It’s not just larger firms at risk; smaller firms suffer disproportionately. In 2023, over 75% of incident response cases handled by Sophos’ X-Ops Incident Response service were for small businesses, according to the 2024 Sophos Threat Report.
There are several specific threats have become particularly prominent for law firms:
- Ransomware: Ransomware attacks remain a common threat and are increasing in sophistication, posing a significant threat to law firms. They often result in severe disruption, data loss, and extortion attempts. Law firms are desirable targets for ransomware due to the sensitive and valuable information they handle.
- Account Takeover and Email Compromise: These attacks involve cybercriminals gaining unauthorised access to email accounts, often to commit fraud or data exfiltration. Email attacks often occur when communications are interrupted, and banking details are altered during sensitive transactions, such as property settlements. Attackers typically use stolen credentials and increasingly ‘pass-the-cookie’ attacks to bypass multi-factor authentication (MFA).
- Human Threats: Internal threats, such as employees inadvertently clicking on phishing links or mishandling sensitive information, pose significant risks. User awareness plays a crucial role in mitigating these threats. Regular training and awareness programs help employees recognise and avoid potential cyber threats and raise awareness about every employee’s role in managing cyber risk for your firm.
Privacy Act and Director Responsibilities
Directors have additional responsibilities for cyber under the Privacy Act 1988, Notifiable Data Breaches (NDB) Scheme, and Corporations Act, encouraging organisations to consider how personal information is collected, used, and managed in Australia.
- Privacy Act 1988: The Privacy Act obligates organisations to protect personal information and report breaches. It includes a provision for class actions, allowing victims of cyber security breaches to seek compensation.
- NDB Scheme: As part of the Privacy Act, the NDB scheme created enforceable legislated penalties, with individuals attracting a maximum of $2.5 million and $50 million or 30% of company turnover for corporate entities. These strict penalties increased in 2022 after Optus and Medibank suffered attacks.
- Corporations Act: Company directors are charged with conducting business under the Corporations Act 2001, which includes cyber security as part of company management.
Proposed Changes and Future Outlook
In addition to current laws, the Government is considering further strengthening cyber security regulations under Australia’s Cyber Security Strategy 2020. The proposed changes, which are expected to impact legal practices, include:
- Establishing Cyber Security Requirements: Establishing a policy framework that includes policies and requirements for businesses to have a minimum level of cyber hygiene across all industries, including law firms.
- Enhancing Disclosure: Businesses might be obliged to outline the technological security aspects inherent to the products and services rather than general information.
- Strengthening Consumer Protections: Legislative reforms are being implemented to propose appropriate penalties to victims of data loss, which may increase the risks for legal practices to sustain in the event of a cyberattack.
Additionally, the Attorney-General’s Department’s review of the Privacy Act 1988 has proposed 116 changes that further influence how legal practices handle data and data security. As these changes unfold, law firms must stay informed and proactive.
How to Manage Cyber Security Risk
Effective cyber risk management in law firms goes beyond adding layers of technology; it requires a proactive and comprehensive approach that considers your people, processes, and technology. While the complexity of cyber threats is increasing, several relatively simple foundational measures can significantly reduce risk.
Law firms in Australia should implement the following strategy as provided by the Essential Eight Strategies. The ACSC developed the Essential Eight as a baseline for cyber security in any organisation, which consists of foundational security controls under the following categories:
- Patching applications: This involves patching applications and security vulnerabilities within acceptable timeframes, and vulnerability scanning is performed to identify missing patches or updates for security vulnerabilities.
- Patching operating systems: This involves patching operating systems and security vulnerabilities within acceptable timeframes, similar to application patching. This is achieved through vulnerability scanning, indicating missing patches or safety vulnerability updates.
- Enforcing multi-factor authentication: MFA requires specification of the methods used for authentication to avoid weaker implementations. Additionally, authentication events shall be logged for forensic or incident response activities.
- Restricting administrative privileges: Restricting administrative privileges requires controls to enforce the principle of least-privileged role-based access control, measures to validate privileged access and logging of events to aid in forensic and incident response activities.
- Application control: Application control is primarily designed to prevent the execution and spread of malicious code. It can also prevent the installation or use of unapproved applications. Controls ensure that only approved applications (e.g., executables, software libraries, scripts, installers, compiled HTML, HTML applications, control panel applets, and drivers) can be executed.
- Restricting Microsoft Office Macros: Microsoft Office files can contain embedded code, known as macros, that can contain commands designed to automate tasks. However, macros can be used for malicious activities, and restricting Office macros or measures to only allow trusted macros to execute are used to mitigate this risk.
- User application hardening: Requires the implementation of controls to prevent attackers from using certain applications to download and run malicious code.
- Regular backups: Regular backups help protect against data loss and ensure recovery in case of a cyber incident. The control emphasises the importance of securely storing backups, regular testing, documentation, and procedures.
Law firms should consider the maturity levels associated with the Essential Eight to enhance their cyber resilience. Maturity Level 2 (ML2) focuses on adversaries prepared to invest more time and resources in their attacks and have more effective tools. ML2 is vital for building strong foundational preventative measures, ensuring your business is better prepared to defend against more persistent and sophisticated cyber threats.
- Execute Ongoing Training and Awareness: Employees are often the weakest link in cyber security due to vulnerabilities like phishing, social engineering, or lack of awareness. Continuous training programs educate staff on recognising threats and securely handling sensitive information and raise awareness of all employees’ roles in managing cyber risk in your firms. Regularly updating this knowledge helps prevent incidents and fosters a security-first culture within the firm.
- Security Monitoring & Response: Law firms should develop strong security monitoring and response capabilities to avert any probable risks. Continuous monitoring services, typically a Security Operations Centre (SoC), have the specialised tools and expertise to detect unusual activities and indicators of compromise. Security monitoring and response capabilities are essential for your firm to handle an attack efficiently, as they prompt the detection of suspicious activity within your infrastructure and ensure a swift response to mitigate potential damage.
- Plan for an Incident: An incident response plan should outline how to manage and recover from a cyberattack, including steps to notify relevant authorities and affected clients. Regular evaluations and tabletop exercises can ensure a rapid response and contain the impact. Additionally, regularly reviewing and practising incident response plans is crucial, helping to identify potential weaknesses, ensuring team members are familiar with their roles, and improving the overall effectiveness of the response.
Conclusion
Law firms must prioritise cyber security as custodians of their clients’ sensitive information and critical facilitators of financial transactions. Recent regulatory changes—mainly updates to the Corporations Act, NDB scheme, and Privacy Act—further heighten the importance of data protection practices. To build a resilient cyber security posture, law firms should adopt a layered approach that includes risk assessments and robust incident response planning.
It is important to understand what your IT team or managed service provider does to manage your firm’s cyber risk. While they may support aspects of your cyber security, you are responsible for ensuring they do it correctly and that your business is secure. By following these recommendations, you can proactively work towards reducing cyber risk and be prepared to respond and recover from an incident.
Rodin Can Help Protect Your Clients
Rodin can build a secure framework with the latest tools and expertise to combat cyber threats and protect your business. With over 30 years of experience and a deep understanding of the legal industry, Rodin provides tailored IT solutions that enhance security and streamline operations. Choosing Rodin as your cyber security IT partner for your legal practice is a sound investment in your business’s future. Visit our IT Support Services for Law Firms page to learn how we can protect your clients’ information and safeguard your law firm’s reputation.
