We recently co-hosted a webinar on cyber security in the legal sector with our partners at CloudGuard, and thought it would also be a good topic for a blog. We’ll cover much of the same here: why is the legal sector such a target for attackers, what can we learn from previous incidents, and what does Hexiosec ASM tell us about their attack surfaces.
So why are organisations in the legal sector such a juicy target for attackers? There’s a number of reasons. Firstly, as many law firms are big multinational companies, they unsurprisingly suffer from many of the common issues that largely come from the difficulty of managing IT and accounts for a large number of people in many different locations.
On top of that, they have a number of things that make them good targets for attackers:
Whatever reasons attackers have for targeting them, the threats they face are broadly aligned with those of most organisations:
Various people who focus on threat intelligence are reporting that legal companies are increasingly being targeted. In the UK, it’s prompted the National Cyber Security Centre to release this high-level guide on the threats they face.
In preparing for the webinar we did some quick research into previous cyber security incidents within the legal sector. Unfortunately, a quick Google finds lots of frightening stories.
More recently, the hack of CTS in late 2023 had a big impact on conveyancing and therefore house purchases in the UK. The root cause there was apparently the Citrix Bleed vulnerability.
Aside from CTS and some data breaches, the last few years have seen a string of ransomware incidents from all the big ransomware crews, including:
The final example here is one of the big ones. Coverage on this incident has some terrifying details of what large-scale ransomware events mean to a company:
…an administrator, with administrator privileges, mistakenly clicked on an “update” to an accounting software that the Ukraine office used. This “update” was, in fact, a phishing scam that contained malware.
Despite the fact that DLA Piper’s cybersecurity team in Britain discovered the threat within 20 minutes, the virus nonetheless disabled the firm’s worldwide telephone system and most of its computer network. When employees came into work they were notified to not turn on any computer anywhere within the firm.
…DLA Piper paid over 15,000 hours of overtime to its IT department in attempting to restore the network
“Do Not Fall Down the Rabbit Hole of a Law Firm Data Breach”, Bigger Law Firm
What can we learn from these incidents? As in many incidents, it’s a lot of the same things:
To get an idea about how they’re doing from a cyber security perspective, we put some of the biggest law firms in the UK through Hexiosec.
Given the omminpresent threat of phishing and related attacks such as business email compromise, secure configuration of email records is crucial for all organisations, especially those in the legal sector.
The good news from our research is that all 24 of the biggest law firms in the UK have an SPF record in place, which is the minimum protection against email spoofing. Less impressive is that 6 of them either have no DMARC record, or do have a record but don’t have the policy field (p) set to do anything.
As with any large company, looking at some of the big legal companies we can quickly see how cyber security management gets harder with scale. Here’s an example from the Hexiosec data - all the online assets we can discover for a single company plotted on a map:
This included websites and cloud resources (on both AWS and Azure, in this case). How many IT teams do we think they have? At least three at a guess (US, Europe and the Middle East, and Asia-Pacific), but possibly more. Given this picture you can quickly understand how shadow IT and unmanaged assets are such a common problem for big, multinational companies; they’ve got lots of online assets, spread all over. This is why there’s so much value in finding and managing your external attack surface.
As another example, one of the companies we looked at had 640 websites. Think about what that means. Pretty much every one of them needs maintenance, from the webserver software to the framework and plugins, the TLS certificate and configuration, and the Content Security Policy and HTTP headers.
This problem of scale is also seen in the kinds of issues that Hexiosec finds for these companies. We see unpatched and out of date webservers:
Plus a whole range of website issues. One company has 48 websites with expired certificates:
Best case, these are decommissioned websites than haven’t been properly taken down. But there’s always a chance they’re customer websites storing customer data. If the TLS certificate is lapsed then we can normally assume the website also needs patching and updating.
These issues aren’t limited to the legal sector and anyone who has systems connected to the internet would benefit from understanding the make-up of their attack surface and overall exposure to risk! Take the first steps in securing your attack surface and identifying where your vulnerabilities lie.
Register for our Hexiosec free account and get a snapshot of your attack surface today.
