Law Firms Are Uneducated & Exposed

Law professionals can gain a deeper understanding of the digital threats they face, and why (and how) they can be properly insured.

Insurance thought-leader Ralph Pasquariello offers a cautionary tale about one law firm that recently paid the price for cheapening out on its cyber liability insurance.

“I got called in to insure a firm here in Atlanta,” he recalls. “When I met with them over the last couple of years, they resisted my help and assessment of their coverages. Then, six months ago, they were involved with a business e-mail compromise that cost them $127,000.

“The cyber policy I would have sold them would have cost somewhere around $6,000,” says Pasquariello, cyber/data/network liability specialist and commercial liability consultant for Atlanta-based Snellings Walters Insurance. “Do the math. The loss they incurred was much more than $127,000, as they needed to pay for forensics and restoration costs.”

While that may sound like a good-sized loss, in the larger scheme of cyber losses, it’s still on the low end, and that firm’s blind spot for a major cyber-related loss is not uncommon.

When it comes to purchasing adequate insurance coverage to protect them against digital-based threats, many law firms often spend far less than they should to protect themselves, and put themselves at serious risk.

This is largely due to two key factors: First, most law firms typically do not comprehend the scope of the cyber exposures they face, and second, those firms, like many businesses, possess a very limited understanding of the coverage protections available to them, what losses are covered, and how valuable Cyber insurance can be.

Cyber risks for law firms: A primer

Joshua Motta, CEO/co-founder of cyber insurer Coalition, explains that because law firms act as title agents and hold funds in escrow for their clients, if that firm gets socially engineered or its security fails, any dollar amount between the entire cost of a home to millions of dollars can be lost.

“We have seen criminal actors target law firms due to the role they play in managing large-ticket wire transfers on behalf of their clients,” says Motta. “If an attacker can gain access or social engineer their way to those funds, they can often walk away with hundreds of thousands of dollars.”

If you think only large firms are at risk, think again. Small to midsize law firms, Motta continues, “have the sort of information that criminal actors would love to have, and they’re collecting data on a scale that their size may not necessarily imply.”

One example would be a firm handling a class-action suit for multiple clients against a hospital, in which medical records are involved and held by the firm. “Regulatory fines for the loss of private health information (PHI) can be significant,” Motta stresses. “Law firms collecting this information from clients may not realize the extent to which they’ve set themselves up as aggregators of PII or PHI. That’s a unique exposure.”

One key risk that all commercial businesses are subject to is business interruption due to hacking. “Most people are under the impression that their General Liability insurance will pay for business interruption. It will under general liability risks, but not in the case of a cyber-attack or malware incident,” Pasquariello notes.

Consider, he says, what the cost would be to any size firm if that business has to close its doors for two weeks or four weeks while the proper forensics are done and systems are restored to normal. “The new malware that is out there will not only encrypt your system, it will also migrate to your backup in the cloud,” he explains. “That renders a company useless.”

Likewise, a ransomware attack, in which a firm can get locked out of its computer systems, can cost a firm millions of dollars and lost business, while all of its data is rendered inaccessible. “How much would you pay for an insurance policy to cover those types of damages?” Pasquariello asks.

“Law firms may also be particularly susceptible to ransomware,” says Edward Chang, second vice president, Cyber Risk Management, Bond & Specialty Insurance at Travelers. “There have been instances, for example, where cybercriminals have coerced a ransom payment by threatening to contact a firm’s clients, since law firms may be especially vulnerable to such threats.”

Cyber criminals who use ransomware are now tailoring their ransom demands based on the value of the systems and the data that have been compromised.

“A law firm’s entire business is built on trust,” says Motta. “Any breach or loss of client data can substantially impair that trust, and even become a company-ending event.”

Understanding what’s covered

Uncertainty about exactly what protections are provided in a cyber policy is part of the problem. That’s not always clear to the potential client.

Cyber coverage 101

So what exactly does a cyber policy include for a law firm?

“That’s the million-dollar question, because every cyber policy is different,” says Motta. “There is no standardized policy language. That’s why it’s important to work with a carrier that understands this risk, and whose policy will respond to all possible loss scenarios. Not all policies are created equal.”

Cyber insurance is still relatively new. As a consequence, forms and coverages are still evolving, so it’s important to review the actual policy to ensure that the coverage provided meets the needs of the insured.

Some typical first-party coverages include:

  • Incident response costs: The legal fees and expenses associated with computer forensics, breach notification, and identity monitoring when a security breach occurs.
  • Cyber extortion: Money (or cryptocurrency) paid as a result of threats made to destroy data, attack a computer system, or disclose electronic computer information.
  • Business interruption: Loss of income and expenses to restore operations as a result of a computer system disruption caused by a virus or other computer system attack. Contingent business interruption is available to provide coverage when such a computer system disruption occurs to a third-party service provider, such as a website hosting company, rather than to the insured’s own network.
  • Fraud: Loss of money or securities as a result of computer fraud, funds transfer fraud, or social engineering.

Typical third-party coverages include:

  • Network and information-security liability: Coverage for claims arising from unauthorized access to data, failure to provide notification of a data breach when required by law, or transmission of a computer virus from the insured’s network.
  • Communications and media liability: Coverage for claims arising from copyright infringement, defamation, libel, or slander in electronic content.
  • Regulatory defense expenses: Coverage for claims by government agencies as a result of network and information security liability or communications and media liability.

More recent additional cyber protections include:

  • System failure: Extends business interruption coverage to computer system disruptions caused by any unintentional or unplanned outage of a computer system, not only those caused by viruses; and
  • Reputational harm: Lost profits to an insured resulting from damage to its reputation caused by a data breach.

Some policies will even cover the cost of replacing the actual computer systems impacted by malware. Not every insurer offers that protection; Coalition is one that does. Depending upon the size of your operation, it may be wise to consult your broker or insurer to inquire about availability.

Additionally, many policies offer coverage against physical perils that may be caused by a cyber event, such as bodily damage, destruction of property, or pollution. An example would be a manufacturer that gets hacked and has its entire inventory destroyed when cooling systems are turned off remotely or sprinklers are turned on.

Even if law firms had a better understanding of their risk, however, some would still opt to buy cyber insurance policies that don’t fully cover their exposure; for many, it’s a matter of expense. “People are concerned that cyber insurance is going to be very expensive, so cost is always a big factor” when determining what policy to buy, says Rebecca Rakoski, managing partner at Xpan Law Group, a boutique privacy law firm in Philadelphia.

Educational Opportunity for Insurers

Getting clients and prospects to understand both their exposures and how a comprehensive Cyber policy would respond are the two hurdles that insurance agents and brokers must clear when dealing with any commercial client, especially law firms. That creates an educational opportunity for all involved, particularly on the broker/insurer side.

PropertyCasulaty360

You Might Also Read: 

Cyber Insurance Report 2017-2018:

Cyber Risk Insurance: A View From The Prudential Regulation Authority:

 

« Bots & Ballots Make A Sophisticated Threat
Cybersecurity In Self-Driving Cars »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

ON-DEMAND WEBINAR: Navigating cloud security: The importance of posture management tools

ON-DEMAND WEBINAR: Navigating cloud security: The importance of posture management tools

Watch this webinar to see how cloud security posture management (CSPM) tools can fit into your cloud security strategy.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

CDW

CDW

CDW is a leading multi-brand provider of information technology solutions to business, government, education and healthcare customers in the United States, the United Kingdom and Canada.

Ripjar

Ripjar

Ripjar is a global company of talented technologists, data scientists and analysts designing products that will change the way criminal activities are detected and prevented.

FireMon

FireMon

FireMon is the only agile network security policy platform for firewalls and cloud security groups providing the fastest way to streamline network security policy management.

CERT-PY

CERT-PY

CERT-PY is the national Computer Emergency Response Team for Paraguay.

TUV Sud

TUV Sud

TÜV SÜD is one of the world's leading technical service organisations. Services offered include industrial cyber security.

Deep Instinct

Deep Instinct

Deep Instinct provides comprehensive defense that is designed to protect against the most evasive unknown malware in real-time, across an organization’s endpoints, servers, and mobile devices.

Plixer

Plixer

Plixer delivers a network traffic analytics system used for monitoring, visualization, and reporting of network and security incidents.

Resilience First

Resilience First

Resilience First is a not-for-profit organisation, led and funded by business to strengthen collective business resilience in all areas, including cyber security.

Cynerio

Cynerio

Cynerio develops cybersecurity protections for medical devices, comparing network behavior with a database of medical workflows.

Maximus Consulting (MX)

Maximus Consulting (MX)

Maximus designs and delivers corporate-wide information security management system with our full-time IRCA Accredited consulting team.

Quantea

Quantea

Our multi-patented solutions - QP Series Network Analytics Accelerator appliance and PureInsight Analytics Software Suite allows you to capture, analyze, store, replay, network traffic data.

MAXXeGUARD Data Safety

MAXXeGUARD Data Safety

MAXXeGUARD: The High Security Shredder. MAXXeGUARD easily destroys hard disks up to the highest security levels as well as other digital data carriers like SSD’s, LTO’s, USB’s, CD’s etc.

Qrypt

Qrypt

Qrypt has developed the only cryptographic solution capable of securing information indefinitely with mathematical proof as evidence.

StrongBox.Academy

StrongBox.Academy

StrongBox.Academy provides cybersecurity training courses that are tailored to the specific needs and challenges of the industry.

SafeBase

SafeBase

Safebase provide the infrastructure for Trust Communication. Our Trust Center enables Security and Sales teams to share and automate access to security, compliance, and privacy information.

Securin

Securin

Securin offers a comprehensive portfolio of solutions including Attack Surface Management, Vulnerability Intelligence, Penetration Testing, and Vulnerability Management.