The Verdict is in: Information Governance Strategies for Legal Firms

According to reports, 1 in 4 law firms are victims of a data breach. Chilling statistics, particularly when you consider the sheer breadth of discovery data that firms possess—trade secrets, private client information, undisclosed corporate mergers—all of which makes them a highly attractive target to cybercriminals.

An article from Legaltech News discusses the evolution of cybersecurity threats to the legal industry in recent years. “There was a time when cyberattacks in the legal industry could be thought of merely as a consequence of law firms representing or taking on the powerful, connected, or controversial;
Fast-forward a few years, and cyberattacks start to look less like case-specific spectacles… and more like a daily assault by burglars and common criminals.”

And hackers aren’t only targeting biglaw; with the migration of eDiscovery data to the cloud in favor of paperless offices, every firm is at high risk for becoming the next victim.

Legal firms do not have to be at the mercy of malicious hackers, and they certainly should not sit idly without taking action. The increasing number of cyber threats has prompted many firms to take the initial steps to safeguard against future attacks. Here are some strategies that firms can implement to help govern their data in the cloud:

 

Lock Down Documents with Digital Rights Management

You may think that sharing digital files via email or Dropbox is fairly secure, but those programs cannot guarantee that your files won’t end up in unauthorized hands. Legal firms that are managing their discovery data in the cloud should take document security a step further and look for tools that provide built-in digital rights management (DRM). DRM security controls let you set user permissions at the document level for viewing, printing, editing, and downloading files to ensure that during case review the only users accessing your proprietary documents are the ones that have permission to do so. With DRM, individual permissions can be turned on/off at any time or revoked altogether when there is no longer the need for a user to access files.

 

Integrate Collaborative Security Tools

To ensure compliance with today’s eDiscovery standards and the rules around electronically stored information (ESI), firms should look for solutions, often from third-party software providers, that provide robust and collaborative security tools for functions like redaction, advanced search, and watermarking. When implemented properly, these tools help create a secure and functioning framework to govern long-term data security.

 

Auto-Redaction & Search

Most personally identifiable information (PII) data follows a typical pattern (think social security numbers and credit card information), which means that, if compromised, this data is essentially low-hanging fruit for hackers. Advanced search tools should be able to quickly search case files for matches on keywords, phrases, and regular expressions. With auto-redaction, you can permanently remove the confidential data for each match. The end result is a PDF with no traces of the redacted information. After all, the easiest and most surefire way to preserve sensitive client information is to eliminate it altogether.

 

Watermarking & Digital Signatures

Watermarking and digital signatures are other features that can be easily integrated into legal applications to help prevent forgery and unauthorized file sharing. Many software companies offer these features and more as APIs that can be easily integrated to enhance client confidentiality and legal applications.

 

Encrypt Discovery Data

Encryption is a basic but vital component of information governance strategy, and one that many firms have previously overlooked. Properly encrypted data will protect files both in-transit and also at rest, to ensure that content is secure during all stages of the document lifecycle—from uploading, to storing, sharing, and downloading. So even if hackers are able to access a system, any data they find will be inaccessible without the proper decryption codes.

 

The Case for Third-Party Software Providers

Many firms are looking to third-party software providers to help deliver the security standards and tools necessary to help govern their data. This is a particularly appealing option since third-party providers have the tools, resources, documentation, and in-house expertise to help implement the functionality necessary for a proper information governance strategy.

Accusoft provides document and imaging solutions that are completely compliant with North American standards and the European Union’s Data Protection Directive for data security. If you’re looking for a fully integrated suite of scalable security tools for digital rights management, encryption, redaction, watermarking, and more, check out Accusoft’s PrizmDoc suite.