Legal firms, as a sector, are about even with the retail industry when it comes to being targeted by hackers, and they continue to be targeted by attackers.
BitSight’s fourth annual BitSight Insights Industry Benchmark report predicts that in 2017, there will be more attacks on legal service providers, fueled by the desire to acquire sensitive data and to attack a firm's clients.
“Legal service providers have access to a company's intellectual property, financials, strategic plans and private employee information,” said Stephen Boyer, co-founder and CTO of BitSight. “In addition, law firms are one of the most widely-used third-party service providers across the world. The impact of a breach on a law firm could be severe for not only the firm, but also their hundreds of clients.”
The Panama Papers leak effectively showcases this.
The BitSight Security Ratings Platform generates objective, outside-in ratings on companies’ security performance. Using evidence of security outcomes from networks around the world, BitSight applies sophisticated algorithms to produce daily security ratings ranging from 250 to 900, where higher ratings equate to lower risk. The legal sector had the second highest percentage of companies with a security rating of 700 or higher, only trailing finance, and in line with retail.
More than 60% of organizations examined from the legal sector are exposed to DROWN, a major communications protocol vulnerability, specifically affecting the SSL/TLS protocol.
When it comes to other verticals, the report also found that Bedep is the most common machine compromise across all industries examined; government, energy/utilities and healthcare sectors saw the highest rates of this botnet.
Nearly 80% of organizations across all industries examined are exposed to Logjam or POODLE, both of which again specifically affect the SSL/TLS protocol.
Previous studies from BitSight show that companies with a security rating of 500 or lower are almost five times more likely to experience a publicly disclosed breach than companies with a security rating of 700 or higher. As part of this year's Industry Index Report, researchers examined whether companies moved into this cybersecurity risk zone of 500 or lower over the last six months and found that government and energy/utilities were the only two industries where the number of companies in this zone increased, indicating poor cybersecurity performance in these sectors.
Photo © Junai Enterprises