Law Times

Law Times • May 25, 2015 Page 11 www.lawtimesnews.com Cyber security Tips for staying safe in the cloud By marg. Bruineman For Law Times T here was something in the fine print that just didn't sit well with Patricia Virc. While the computer leasing service, which included many layers of conveniences, was just what she needed, a line item in what was probably a standard contract set off alarm bells. Should the client fail to pay, the company reserved the right to confiscate the computer. The problem is Virc is a commercial litigator who runs a cloud-based practice from her computer. That's why she liked one aspect of the service that would clear out her hard drive should it ever be lost or stolen and another that would replace the computer with a new one with the infor- mation restored. But that one confiscation risk overwhelmed all of the conveniences. The con- tract also indicated her business could be transferred to another company in the case of a sale. Virc decided those terms weren't acceptable. As a result, she refused to sign the contract and set out to find computer services elsewhere. "Nothing is completely risk free," she says, noting she tries to determine whether the risk is a tolerable one. In the case of the computer company, she con- cluded it wasn't. Virc has enjoyed the conve- niences offered by technology, although she found remote ac- cess to a server cumbersome. By 2011, she was running her civil litigation practice entirely on the cloud. That allows her remote access to all of her documents and software no matter where she is. "I'm paperless and I operate in the cloud," she says. Given the concerns, Virc makes a point of managing se- curity issues she considers perti- nent and ensures she uses tech- nology to keep that information safe. "You have to make it your business to find out where all your information is kept," she says. She doesn't think any gov- ernment agencies would have an interest in her work or her client list. But if she did have sensitive information, she would keep it off the Internet because no mat- ter how good a system is, noth- ing is perfect. In trying to maintain se- curity in the digital age, Virc acknowledges there are two aspects she needs to always be cognizant of: ensuring a copy of what she has in the cloud also exists on her hard drive or else- where and keeping on top of the risks while taking care to do the right things using the best tools to minimize them. According to the American Bar Association, the percentage of lawyers in the Unites States who used cloud-based software and services jumped to 31 per cent in 2013 from 21 per cent in 2012. But with lawyers having to do what they can to keep their client information safe, regular security audits are an important consideration. Sharon Nelson suggests go- ing through a detailed informa- tion checklist to identify vul- nerabilities. While much of the concern centres around tech- nology and software, there also needs to be a specific focus on managing concerns like those Virc encountered. Nelson, a U.S. lawyer, pro- vides information security ser- vices through her company, Sensei Enterprises Inc. Her list includes being cognizant of is- sues such as having written policies in place signed by all employees, preparing a disaster recovery plan, and creating poli- cies outlining the use of the use of individual devices and net- works. "One of the things people overlook a lot is training," she says. Everyone in the firm needs to be aware of all of the risks. One click on the wrong link could release paralyzing malware that could affect the firm's entire sys- tem, a problem that has grown rapidly in a very short period of time. Training will help people stay on top of the risks. But because those risks keep changing, Nel- son emphasizes the need to con- duct training on a regular basis to keep everyone aware of the latest developments. Another risk is programs that are out of circulation and with- out support. She points to Win- dows XP as an example of soft- ware that's now without support or security updates. Continued use of that program could add unnecessary risk to the organi- zation. "So it's a never-ending war we're fighting," says Nelson. When it comes to using cloud services, a good starting point in choosing a provider is to ensure the financial stabil- ity of the company. Nelson also says encryption will protect the data from access by unau- thorized individuals and notes maintaining control of the mas- ter encryption key provides the lawyer with further control. Lawyers working on the cloud also need to investigate where the company is stor- ing their information. Some services use third-party data centres elsewhere in the world. Safety of information stored in the cloud in another geographic location could be subject to the laws of the hosting jurisdiction, something that may affect the confidentiality of client or other information. Agreements with the cloud provider aren't always condu- cive to the needs of a lawyer. Some companies claim owner- ship of all data uploaded to their service. Close examination of the terms of the service provider will identify any potential prob- lems. And when signing on, it helps to ensure there's an exit strategy with acceptable terms. A cloud-computing checklist is available through the Law So- ciety of British Columbia. The extensive list suggests a cloud product designed for lawyers could address their specific pro- fessional, ethical, and privacy requirements. Another idea is to develop a protocol for all mem- bers of the firm to follow when placing data on the cloud service. While there are risks when operating in the cloud, a profes- sional service may offer more protection than a law office can ensure on its own, says Dan Pin- nington, vice president of claims prevention and stakeholder rela- tions at LawPRO. And he points out that much of what most people do online is already in the cloud, such as Internet banking, e-mail ac- counts through Gmail and Ya- hoo, social media, and tools that lawyers like to use like Evernote and Dropbox. Nevertheless, Pinnington notes lawyers need to be aware of the risks involved in using cloud services. "In a worst-case scenario, the finan- cial and business interruption associated with a cyber breach could destroy your firm," he says. "There's a bunch of things, simple things, that lawyers and law firms can do." While a professional service would be in the best position to cover all of the bases, LawPRO suggests protecting e-mail, up- dating security software, lock- ing up hard drives and software through passwords and chang- ing them regularly, and keeping operating systems and program updates current. When working remotely, lawyers should con- sider installing a firewall on the Internet connection, regularly backing up information, and restricting the type of data that's accessible. Despite her concerns, Virc says keeping files and informa- tion on the cloud is just as secure as traditional filing methods and is perhaps safer. When people ask her about the safety of keeping infor- mation in the cloud, she has a quick response: "As opposed to what? Leaving documents on a desk?" LT FOCUS TF: 1.888.223.0448 T: 416.868.3100 YOUR ADVANTAGE, in and out of the courtroom. (YHU\WLPH\RXUHIHUDFOLHQWWRRXUßUP\RXDUHSXWWLQJ \RXUUHSXWDWLRQRQWKHOLQH,WLVDOODERXWWUXVWZHOOSODFHG Since 1936 Thomson, Rogers has built a strong, trusting, and collegial relationship with hundreds of lawyers across the province. As a law firm specializing in civil litigation, we have a record of accomplishment second to none. With a group of 30 litigators and a support staff of over 100 people, we have the resources to achieve the best possible result for your client. Moreover, we are exceptionally fair when it comes to referral fees. We welcome the chance to speak or meet with you about any potential referral. We look forward to creating a solid relationship with you that will benefit the clients we serve. www.thomsonrogers.com TRUST DAVID TENSZEN | DAVID NEILL | STACEY STEVENS Untitled-2 1 2015-05-20 2:45 PM 'You have to make it your business to find out where all your information is kept,' says Patricia Virc.

• Cover