Law Firms Are Uneducated & Exposed

Law professionals can gain a deeper understanding of the digital threats they face, and why (and how) they can be properly insured.

Insurance thought-leader Ralph Pasquariello offers a cautionary tale about one law firm that recently paid the price for cheapening out on its cyber liability insurance.

“I got called in to insure a firm here in Atlanta,” he recalls. “When I met with them over the last couple of years, they resisted my help and assessment of their coverages. Then, six months ago, they were involved with a business e-mail compromise that cost them $127,000.

“The cyber policy I would have sold them would have cost somewhere around $6,000,” says Pasquariello, cyber/data/network liability specialist and commercial liability consultant for Atlanta-based Snellings Walters Insurance. “Do the math. The loss they incurred was much more than $127,000, as they needed to pay for forensics and restoration costs.”

While that may sound like a good-sized loss, in the larger scheme of cyber losses, it’s still on the low end, and that firm’s blind spot for a major cyber-related loss is not uncommon.

When it comes to purchasing adequate insurance coverage to protect them against digital-based threats, many law firms often spend far less than they should to protect themselves, and put themselves at serious risk.

This is largely due to two key factors: First, most law firms typically do not comprehend the scope of the cyber exposures they face, and second, those firms, like many businesses, possess a very limited understanding of the coverage protections available to them, what losses are covered, and how valuable Cyber insurance can be.

Cyber risks for law firms: A primer

Joshua Motta, CEO/co-founder of cyber insurer Coalition, explains that because law firms act as title agents and hold funds in escrow for their clients, if that firm gets socially engineered or its security fails, any dollar amount between the entire cost of a home to millions of dollars can be lost.

“We have seen criminal actors target law firms due to the role they play in managing large-ticket wire transfers on behalf of their clients,” says Motta. “If an attacker can gain access or social engineer their way to those funds, they can often walk away with hundreds of thousands of dollars.”

If you think only large firms are at risk, think again. Small to midsize law firms, Motta continues, “have the sort of information that criminal actors would love to have, and they’re collecting data on a scale that their size may not necessarily imply.”

One example would be a firm handling a class-action suit for multiple clients against a hospital, in which medical records are involved and held by the firm. “Regulatory fines for the loss of private health information (PHI) can be significant,” Motta stresses. “Law firms collecting this information from clients may not realize the extent to which they’ve set themselves up as aggregators of PII or PHI. That’s a unique exposure.”

One key risk that all commercial businesses are subject to is business interruption due to hacking. “Most people are under the impression that their General Liability insurance will pay for business interruption. It will under general liability risks, but not in the case of a cyber-attack or malware incident,” Pasquariello notes.

Consider, he says, what the cost would be to any size firm if that business has to close its doors for two weeks or four weeks while the proper forensics are done and systems are restored to normal. “The new malware that is out there will not only encrypt your system, it will also migrate to your backup in the cloud,” he explains. “That renders a company useless.”

Likewise, a ransomware attack, in which a firm can get locked out of its computer systems, can cost a firm millions of dollars and lost business, while all of its data is rendered inaccessible. “How much would you pay for an insurance policy to cover those types of damages?” Pasquariello asks.

“Law firms may also be particularly susceptible to ransomware,” says Edward Chang, second vice president, Cyber Risk Management, Bond & Specialty Insurance at Travelers. “There have been instances, for example, where cybercriminals have coerced a ransom payment by threatening to contact a firm’s clients, since law firms may be especially vulnerable to such threats.”

Cyber criminals who use ransomware are now tailoring their ransom demands based on the value of the systems and the data that have been compromised.

“A law firm’s entire business is built on trust,” says Motta. “Any breach or loss of client data can substantially impair that trust, and even become a company-ending event.”

Understanding what’s covered

Uncertainty about exactly what protections are provided in a cyber policy is part of the problem. That’s not always clear to the potential client.

Cyber coverage 101

So what exactly does a cyber policy include for a law firm?

“That’s the million-dollar question, because every cyber policy is different,” says Motta. “There is no standardized policy language. That’s why it’s important to work with a carrier that understands this risk, and whose policy will respond to all possible loss scenarios. Not all policies are created equal.”

Cyber insurance is still relatively new. As a consequence, forms and coverages are still evolving, so it’s important to review the actual policy to ensure that the coverage provided meets the needs of the insured.

Some typical first-party coverages include:

  • Incident response costs: The legal fees and expenses associated with computer forensics, breach notification, and identity monitoring when a security breach occurs.
  • Cyber extortion: Money (or cryptocurrency) paid as a result of threats made to destroy data, attack a computer system, or disclose electronic computer information.
  • Business interruption: Loss of income and expenses to restore operations as a result of a computer system disruption caused by a virus or other computer system attack. Contingent business interruption is available to provide coverage when such a computer system disruption occurs to a third-party service provider, such as a website hosting company, rather than to the insured’s own network.
  • Fraud: Loss of money or securities as a result of computer fraud, funds transfer fraud, or social engineering.

Typical third-party coverages include:

  • Network and information-security liability: Coverage for claims arising from unauthorized access to data, failure to provide notification of a data breach when required by law, or transmission of a computer virus from the insured’s network.
  • Communications and media liability: Coverage for claims arising from copyright infringement, defamation, libel, or slander in electronic content.
  • Regulatory defense expenses: Coverage for claims by government agencies as a result of network and information security liability or communications and media liability.

More recent additional cyber protections include:

  • System failure: Extends business interruption coverage to computer system disruptions caused by any unintentional or unplanned outage of a computer system, not only those caused by viruses; and
  • Reputational harm: Lost profits to an insured resulting from damage to its reputation caused by a data breach.

Some policies will even cover the cost of replacing the actual computer systems impacted by malware. Not every insurer offers that protection; Coalition is one that does. Depending upon the size of your operation, it may be wise to consult your broker or insurer to inquire about availability.

Additionally, many policies offer coverage against physical perils that may be caused by a cyber event, such as bodily damage, destruction of property, or pollution. An example would be a manufacturer that gets hacked and has its entire inventory destroyed when cooling systems are turned off remotely or sprinklers are turned on.

Even if law firms had a better understanding of their risk, however, some would still opt to buy cyber insurance policies that don’t fully cover their exposure; for many, it’s a matter of expense. “People are concerned that cyber insurance is going to be very expensive, so cost is always a big factor” when determining what policy to buy, says Rebecca Rakoski, managing partner at Xpan Law Group, a boutique privacy law firm in Philadelphia.

Educational Opportunity for Insurers

Getting clients and prospects to understand both their exposures and how a comprehensive Cyber policy would respond are the two hurdles that insurance agents and brokers must clear when dealing with any commercial client, especially law firms. That creates an educational opportunity for all involved, particularly on the broker/insurer side.

PropertyCasulaty360

You Might Also Read: 

Cyber Insurance Report 2017-2018:

Cyber Risk Insurance: A View From The Prudential Regulation Authority:

 

« Bots & Ballots Make A Sophisticated Threat
Cybersecurity In Self-Driving Cars »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Link11 GmbH

Link11 GmbH

Link11 provides DDoS protection solutions to protect websites and complete server infrastructures from DDoS attacks.

Chatham House

Chatham House

Chatham House is an independent policy institute based in London. Topics cover foreign affairs and defence including cyber security.

CensorNet

CensorNet

CensorNet's award-winning cloud-based security software delivers enterprise-class security and flexibility to over 4,000 customers around the world.

HackLabs

HackLabs

HackLabs is a penetration testing company providing services for network security, web application security and social engineering testing.

SISA

SISA

SISA is a payment security specialist providing payment security assurance services, training and products to over 1,000 customers across the globe.

CodeOne

CodeOne

CodeOne provides solutions for website and web app security.

SEEK

SEEK

SEEK create world-class technology solutions to address the needs of job seekers and hirers across multiple sectors including cybersecurity.

Redwall Technologies

Redwall Technologies

Redwall provides cybersecurity expertise and technology to prevent and respond to emerging threats against mobile applications and connected infrastructures.

TAG Cyber

TAG Cyber

TAG Cyber's mission is to provide world-class cyber security research, advisory, and consulting services to enterprise security teams around the world.

CRI Group

CRI Group

CRI Group excels at deterring, detecting and investigating crimes against businesses using a global network of professionals specially trained in Anti-Corruption, Risk Management and Compliance.

Sencode Cyber Security

Sencode Cyber Security

Sencode provides a range of IT security solutions and services, including penetration testing and cyber awareness training to help mitigate the growing risks to your corporate infrastructure.

iSTORM

iSTORM

iStorm specialise in supporting organisations who require a range of Privacy, Security and Penetration testing related services.

CertiProf

CertiProf

CertiProf has been enhancing professional lives since 2015, offering a wide range of IT certifications and agile framework training.

Numen Cyber Technology

Numen Cyber Technology

Numen Cyber Technology is committed to becoming a Threat Discovery and Response expert for corporate customers.

CFTS

CFTS

CFTS 'Computer Facilities Technical Services' is a Ugandan ICT Support Company that specialises in infrastructure and support services including network security.

Strata Information Group (SIG)

Strata Information Group (SIG)

Strata Information Group (SIG) is a trusted partner in IT solutions and consulting services.