Malicious actors are continuously looking for inventive ways to steal sensitive information from organizations with highly-sensitive and high-value data. Many of these organizations have robust security infrastructures in place, making a successful breach challenging. As a result, cybercriminals have turned to third parties, such as organizations within the legal sector, to obtain the sensitive data, intellectual property, M&A information and trade secrets they are after.
Safeguarding this information remains a high priority, and should it be compromised, the organization faces many repercussions, from legal penalties to financial liabilities, to the loss of clients, including the ability to remain in business.
Legal organizations are actively turning to deception technology as the preferred method for early and accurate detection of threats that have bypassed other security controls. Deception technology gives legal organizations the internal visibility often lacking in traditional security infrastructures.
Why Detection is a Priority for the Legal Sector
Targeted Attacks
80% of the largest firms in the US have experienced a malicious breach due to a targeted attack.
Supplier Compliance
48% of law firms are audited by clients for performance against cybersecurity standards.
GDPR Compliance
Fines up to $24.6 million or 4% of annual revenue, whichever is greater.
Insider Threats
11.5 million files leaked in the Panama Papers scandal due to an insider.
BENEFITS
Legal organizations choose Attivo Networks® deception-based threat detection for:
Early and Accurate Detection
Early detection of in-network human and automated attackers that are targeting confidential client data, mergers and acquisitions details and fiduciary records.
In-Network Visibility
Accurate visibility to in-network threats and “east-west” traffic to show prospective and existing clients that a solution is in place to detect and respond to network compromises and policy violations quickly.
Scalability
Deception easily scales to cover headquarters, remote and distributed offices. Actionable alerts, automation, and native integrations empower fast response to alerts and are ideally suited for organizations with limited security operations teams.
Simplified Incident Response
Attack analysis, correlation, and forensic reporting are automated for faster understanding of threats. Third party integrations empower automated blocking, isolation, and threat hunting for a accelerated response.
DECEPTION USE CASES FOR
LEGAL ORGANIZATIONS
- THE INTERNAL RISK
- TARGETED ATTACKS
- MALWARE, RANSOMWARE, CRYPTO-MINING
- CYBERSECURITY REQUIREMENTS FROM CLIENTS
- GDPR & SIMILAR REQUIREMENTS
Internal Risk
Insiders and suppliers have an inherent advantage in their attack because they already have access to the network. Detection of nefarious activities or policy violations of employees can be extremely difficult to detect and are often missed by security teams and traditional security tools. Attempts to use behavioral analysis to identify anomalous behavior will often result in a flood of false positives that often result in missed detection of a compromise.
Outmaneuvering an internal threat can be effectively done with threat deception. By strategically placing traps and lures inside the network, insider adversaries will be attracted and deceived into quickly revealing their activities, before they can compromise client data, whether accidentally or intentionally.
Targeted Attacks
Attackers who target specific victims typically have a high level of expertise and extensive resources at their disposal to conduct their schemes over a long period of time. They often have specific documents and files they are looking to obtain. They customize, adjust and refine their tactics to counter their victim’s defenses, often leaving legal organizations without a solid security infrastructure in a precarious situation.
Today’s targeted attacker is making fewer mistakes, making a reactive defense less and less effective. With deception at the network, endpoint, data, and application layers, organizations have a detection mechanism to alert on attackers as they attempt to reuse stolen credentials, conduct reconnaissance, and laterally move from system to system. Additionally, by gathering early and detailed threat-, adversary-, and counter-intelligence, organizations can take a proactive posture to their organization’s security and ultimately call checkmate on the attacker
Malware, Ransomware, Crypto-Mining
Innovative tactics and talent are consistently being applied to malicious computer code resulting in new forms of malware, ransomware, and crypto-mining attacks.Remote access trojans and botnets regularly challenge information security teams within the legal sector, with exceedingly high disruption to operations and business impact. Ransomware poses a different type of threat to critical client information, targeting the integrity and availability of the data. The threat of catastrophic data loss due to a ransomware infection is a risk no legal organization takes lightly, as illustrated by the DLA Piper Petya incident.
Network-enabled malware, such as botnets, RATs, and ransomware, try to propagate to systems connected to the compromised endpoint. Whether it is co-opting network and computing resources as part of a botnet, allowing outsiders access to steal passwords and data, or encrypting data for ransom or destruction, these infections use their network connectivity to rapidly spread throughout the environment. Deception technology provides the early and accurate detection required to quickly detect and deter such activity within a legal organizations network.
Cybersecurity Requirements from Clients
Success in the legal industry is rooted in an unparalleled level of trust between lawyers and their clients. Clients engage with lawyers in the open manner they do because of the promise of client confidentiality. When that confidence is compromised, the lawyer’s most essential asset can no longer be of use to them. Firms are increasingly realizing that clients are measuring them not just by the services they provide, but on how well they can secure their clients’ data.
Deception can play a powerful role in demonstrating how the organization detects threats that bypass perimeter controls. The solution can also be used to demonstrate advanced measures for detecting insider threat activity.
GDPR and Similar Requirements
Legal organizations handle a great deal of private personal information through collection from third parties such as, clients, witnesses, opposing parties, etc. so GDPR and similar regulations affect them greatly. Under GDPR, law firms need to be extra cautious about the vendors they work with to access client data and should not assume that they are in compliance. In addition, to the threat of cyber attacks, many firms are rapidly adopting new solutions that are designed to detect attacks early, accurately, and provide a detailed analysis that can explain the magnitude of the breach, as well as the corrective actions to contain it. This is an area where deception technology can help.
Deception can better prepare organizations for GDPR by providing powerful security controls that not only detect attacks before they become full blown data breaches, but by gathering forensic information to assist in meeting the regulatory reporting requirements.
PARTNERSHIPS
ILTA
ILTA has a strong reputation for delivering relevant, peer-developed programming to its constituents around the globe. Attivo Networks actively participates in ILTA events including LegalSEC and ILTACON.
ASSOCIATIONS
FS-ISAC
Attivo Networks is an Affiliate Board Advisor of the Financial Services Information Sharing and Analysis Center (FS-ISAC), a community of financial organizations working together to share cyber and physical threat intelligence and combat cybercrime activities. In 2017, FS-ISAC created the Global Resilience Federation (GRF) which is a “community of communities” including the Legal Services Information Sharing and Analysis Organization (LS-ISAO) and other not-for-profit ISACs, ISAOs, and CERTs.
Threat Deception Case Studies
Protecting National Data Information
Company
Federal Information Agency
Situation
The organization was concerned about potential compromise. Additionally, the federal information agency required a reliable detection security method.
Outcome
The customer selected the Attivo ThreatDefend platform with BOTsink decoys deployed throughout the environment. ThreatStrike was deployed for endpoint deception and ThreatPath was utilized for attack path assessment. As a result, the organization gained early and accurate detection of in-network threats.
SPEAK TO A SECURITY SPECIALIST
Ready to find out what the Attivo Networks solution can do for your organization? Our security experts are standing by, ready to answer your questions.
DECEPTION REDUCES DWELL TIME FOR THE LEGAL SECTOR
Deception technology uniquely addresses dwell time challenges legal organizations face for which there traditionally has been no easy solution. A deception solution provides immense value because it accurately and efficiently detects threats that are already inside the network and have bypassed perimeter controls.
SPOTLIGHT
Deception-Based Threat Detection for Legal Organizations
