Cyber security: Law firms exposed
Almost three-quarters of UK law firms have at least one employee password leaked into publicly available sources, the largest study of its kind has found.
Of the 5,140 firms audited, 72% had one or more instances of employee username and password combinations evident in lists circulating on the Dark Web, which cybercriminals could use to enter a firm’s IT system.
In total, researchers found just over a million passwords relating to firms in the study, an average of 195 password combinations per firm.
IT services company Atlas Cloud conducted non-intrusive cyber security audits, meaning there was no attempts at hacking.
It found further cyber-threats, with DMARC, a key protective factor that stops criminals from hijacking corporate domains, implemented by only 46% of firms – a hijacked domain would allow a criminal to send emails that appear to come directly from the firm.
More than half (54%) of firm’s ‘digital attack profiles’ were large, but few of these were actually large firms, as they had better protections in place.
Pete Watson, chief executive of Atlas Cloud, commented: “When it comes to cyber security, being a mile wide and an inch deep doesn’t do you any good. If the majority of big firms can operate a small attack profile, any firm can.”
One in seven firms had the government’s Cyber Essentials certificate, covering a range of defence mechanisms. This is recommended as part of Lexcel accreditation and is required for all public sector case work.
At least 53% of firms had adopted specialised phishing protection technologies that filter out emails suspected as impersonation, a tactic that standard ‘spam’ filters aren’t able to recognise.
Mr Watson added: “The sheer volume of password combinations available to criminals is a stark reminder of the threat that cyber poses to a firm. You can minimise this risk by applying multi-factor authentication on your systems, which adds an additional one-time authentication token, but criminals have been known to find ways around this too.
“It’s circumvented by tricking users to do something. That means the only true way to eliminate this threat is ensuring everyone representing your firm has a strong awareness of the tactics criminals are using today.”
