Lawyers clueless about data security

Research exposes legal eagles' lack of gumption around protection of sensitive data

UK law firms are failing to securely protect sensitive data stored on mobile devices, according to recent research from IT security vendor Credant Technologies.

A survey of 100 legal firms revealed over 90 per cent of lawyers believe their data is protected because they are securing it with a password, while four per cent do not use any security whatsoever.

In addition, 24 per cent confessed to having previously misplaced at least one mobile device containing confidential documents.

In light of these results Credant is advising companies to encrypt their data on every device and invest in a solution which can detect devices trying to connect to the enterprise and sync with corporate data.

The survey revealed that lawyers prefer to use their Blackberries or PDAs, with 67 per cent claiming they store work information this way compared to 63 per cent who prefer to use their laptops.

Michael Callahan, vice president for global marketing at Credant, said “This creates an uncontrollable environment for the IT security staff as they simply can not keep track of which devices they have secured and which they have not.

“Our advice is to implement a data protection policy that ensures all handheld, laptop, desktop and other removable media (like USB sticks) are encrypted, managed and controlled centrally which then enables the IT guys to be able to suspend access to the information if it is misplaced or stolen.”

The survey also found that one in five lawyers use their own devices to store client information, consequently slipping under their company’s security radar.

Amongst these unprotected devices lawyers were found to be storing sensitive information including business emails (85 per cent), work contact details (65 per cent) client contact details (50 per cent) and their firm’s data (42 per cent).

Robert Schifreen ex-hacker, and now an IT security consultant, said “Passwords are just inadequate if you have confidential sensitive information residing on a mobile device. You can download cracking software from Google that can break the average password in less than 30 minutes.

“These findings show just how naïve the legal profession is when it comes to data security and I suspect other professions are just as bad, if not worse. The only answer is, if you store sensitive data, you must encrypt it.”