10 Data Leak Prevention Tips for Law Firms
July 27th, 2015
Data leak prevention (DLP) is a subject that comes up again and again. “How do I stop data leaks from occurring?” and “How do I know if a data leak has happened?” are two questions that legal firms want answers to.
The premise of DLP is to stop intellectual property, client details or other sensitive data from passing into the unprotected Internet. Something that sounds easy, but isn’t. Leaks can happen via email, internet browsing or a breached cloud platform.
You may realise that those are three of the biggest things your firm uses every day and that’s where the difficulty comes in. Setting up a full DLP system is usually difficult and takes a lot of time, technologies and planning. But before you can even start to make a plan you need to understand the fundamentals.
What are the types of data leak?
- In transit
- Being intercepted whilst travelling over the wire, i.e. email, web chat, web traffic, etc.
- At rest
- From areas such as a file share, a database or from a desktop or laptop.
- In use
- From screen captures, clipboard, a printer, USB disk, CD, etc.
Your firm should break down each of these areas, understanding when data is in each vector and how it could leak via the vector. Once you understand what you have and what risks you face on each classification you can start to think about controls and policies. For instance:
- What is your policy on staff plugging in USB sticks?
- What controls will you have to stop sensitive details lying in the printer?
- What is your policy on sharing information via social media?
The controls will vary significantly by but here are 10 areas to consider when contemplating how to keep your sensitive data secure from an accidental or malicious leak.
How can you make data secure?
1. Portable encryption
You should encrypt any sensitive data which leaves the secure confines of your firm’s network. You’ll need software systems to control this as you cannot typically rely on employees to do it. It only takes a lost USB disk, laptop or phone to deliver a severe or critical blow to a firm.
2. Endpoint protection
The data endpoint is typically a computing device, i.e. desktop, laptop, mobile, server, etc. It’s on these devices that IP and confidential data resides or passes through. DLP endpoint protection solutions can protect data inside and outside of the network by controlling functions, such as print, copy, and data transfer to USB devices or a cloud storage platform, such as DropBox.
3. Email content control
Email is a common source of a data leak, as employees use it to send confidential information and documents. Content filtering uses deep content inspection technology to scan the text, images, and attachments of an email, to flag up any potential threats and can alert you if a user tries to send sensitive information.
4. Intelligent firewalls
Data leakage often arises from email, IM or internet use. Firewalls can protect individual computers and whole networks from security threats and can take automatic action against potential data leaks, unauthorised access or malicious behaviour, either by notifying the administrator or by blocking the action.
5. Device control
Endpoint solutions allow administrators to control what devices are in use. They can also see when they have been used, who by and what information was copied, managing the threat of portable storage devices. You should also have effective security policies for your devices, as users typically store email and other sensitive documents on their smartphones and tablets. For example, some required could include the use of complex passwords or to set devices to automatically lock when not in use.
6. Evaluating security permissions
Many users may have access to sensitive data, but do they really need it? Allowing access on a “need-to-know” basis can dramatically reduce your chances of a data leak, accidental or otherwise.
7. Controlling print
Multi-Function printers (MFP) are typically unmonitored and can have a high level of data leak potential. Requiring users to ‘sign in’ before use can reduce this, as they will only have access to certain functions and documents. It also prevents users from leaving sensitive information on the printer, as the document only prints once the correct user has signed in at the MFP.
8. Securing back-ups
Many firms rightly have back-ups of their most important information, but these can be vulnerable too, either from an attack or due to loss. Just like the original data you should encrypt these files, which is a function of most backup software.
9. Image text analysis
Images can be sensitive data in themselves, plus camera-enabled devices like smartphones make it very easy to capture sensitive data. DLP solutions have the ability to analyse text within images, preventing data exposure.
Businesses often assume employees know what information is confidential and what they cannot share. Yet, sometimes a data leak is accidental and can be something as simple as an email to the wrong client. A good security policy is well-defined and easy to understand. Helping users perform important functions with reduced risk and increasing the adoption rate of the policy.
David Clarke’s take on the new Product Security and Telecommunications Infrastructure (PSTI) Bill
QuoStar’s Head of Security and resident CISO David Clarke shares his views on the new piece of legislation to protect the consumer – The Product Security and Telecommunications Infrastructure (PSTI) Bill. “The Product Security and Telecommunications Infrastructure (PSTI) Bill supports the rollout of future-proof, gigabit-capable broadband and 5G networks, and better protects citizens, […]
Why your business needs two Internet connections
Your business’ Internet connection now means so much more than just being able to browse websites. So many programs, services and features rely on an Internet connection that if yours went down, you would feel an instantaneous impact. Businesses constantly use the Internet to communicate with their clients, collaborate with colleagues and access cloud-based systems […]
In the press: Stay safe – Cybercrime in conveyancing
Robert Rutherford, CEO of QuoStar, and Nigel Smith, Managing Partner of Ellis Jones, outline how to protect both firms and clients from scam emails during conveyancing. “The rise in targeted email attacks against solicitors and their clients continues to dominate the headlines, with one couple recently losing a £45,000 deposit after succumbing to an email from a […]