1 min read
Lawyers: A Law Firm's Greatest Asset
Who finds the business serviced by a law firm? Lawyers. Who minds the business serviced by a law firm? Lawyers. Who grinds the business serviced by...
We've crafted solutions tailored to your firm
The world of insurance for law firms can be confusing, and difficult to navigate. We've created this glossary because these common insurance terms should be easy to understand.
3 min read
Sharon D. Nelson Esq., Sensei Enterprises
:
Aug 19, 2024 7:45:00 AM
While lawyers have certainly been aware of deepfakes for years, everyone was fighting malware infections. As we constantly remind lawyers, the cybersecurity world evolves rapidly – and the prudent law firm will evolve as well.
In the past year, deepfakes have become the second most common cybersecurity incident, lagging only behind those persistent malware infections that law firms have been battling for years.
Mind you, we are not suggesting (yet) that law firms are being deluged by deepfakes. However, having watched the rise of deepfakes in businesses, law firms know darn well that they will be invited to the party by cybercriminals – and that they must be prepared.
Over the years, we have given hundreds of CLEs on cybersecurity training for law firms, but for the first time, we are now including training to protect law firms against deepfakes, which may well involve such things as client voice cloning along with other forms of deepfakes.
It only takes a matter of seconds to clone a client’s voice from a sample of the voice. While there are many permutations of deepfakes, a common scenario for a law firm might be a call requesting a lawyer to wire a large sum of money as part of a business transaction. It is amazing how much information cybercriminals have at their command to make such requests plausible.
Law firms hold some of the most sensitive data of their clients, and yet they are unprepared to adequate protect that data. Deepfakes may prove a considerable challenge to law firms if they don’t institute adequate training.
While each deepfake scenario may be different, there are means to defend again deepfakes! Nothing expensive or complicated about this, but why not set a secret code word? Perhaps a word unlikely to come up in a legal conversation like “dinosaur” or “hayride?” Whenever a client calls you – or communicates with you via any form of unsecure audio or video communication, ask for the code word. If they don’t have it, terminate the communication.
Beware, they may say they forgot the code word. Start from the beginning – you call them at a known good number and establish a new code word. Is this perfect or all-inclusive in protecting you? No. But it’s a start and it doesn’t cost a cent.
Do change the code words from time to time, just in case. We’re certain that legal practice management systems will (if they haven’t already) build verification techniques into their systems allowing two-way authentication.
One hallmark: The communication is urgent, particularly when monies are to be wired immediately. The authors all agree that you should take special care when you are asked to deal in cryptocurrencies which are still often fraught with risks.
Gifts cards? Oh yes, we have seen a law firm where an employee was asked to buy gift cards by the “managing partner.” She bought $1200 worth of gift cards which ended up in the criminal’s hands. And no, the firm did not reimburse her. A law firm’s version of “tough love” we suppose.
Other indicators of probable fraud include “don’t tell anybody what you’re doing” warnings, asking for personal/confirmation information, and telling you to keep the communication itself on the “down low.”
The world was a simpler place not so long ago. You could look at a deepfake video and see things like strange skin tones, odd lighting effects or jerky movements. The speech wouldn’t sound quite right or was out of sync. Perhaps the eyes didn’t blink or the body moved a bit strangely. You’ll still see some of the old defects, but increasingly artificial intelligence is making many deepfakes harder to spot.
On the flip side, AI is often now used to detect AI-generated deepfakes, And it’s very likely that, even as AI deepfakes become better and better, so will AI deepfake detection technologies. Our foe is also our friend when it comes to AI.
Worth a careful read: The story of how a finance worker at a multinational firm was tricked into paying out $25 million by a deepfake video call from the company’s chief financial officer which included several members of staff on the call, all of whom were also deepfaked. https://www.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-kong-intl-hnk/index.html. It is time for law firms to prepare for deepfake attacks before they too become headlines!
Sharon D. Nelson is an attorney and the president of Sensei Enterprises, Inc. She is a past president of the Virginia State Bar, the Fairfax Bar Association and the Fairfax Law Foundation. She is a co-author of 18 books published by the ABA. snelson@senseient.com
John W. Simek is vice president of Sensei Enterprises, Inc. He is a Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH) and a nationally known expert in the area of digital forensics. He and Sharon provide legal technology, cybersecurity and digital forensics services from their Fairfax, Virginia firm. jsimek@senseient.com
Michael C. Maschke is the Chief Executive Officer at Sensei Enterprises, Inc. Mr. Maschke is an EnCase Certified Examiner (EnCE), a Certified Computer Examiner (CCE #744), an AccessData Certified Examiner (ACE), a Certified Ethical Hacker (CEH), and a Certified Information Systems Security Professional (CISSP). He is a frequent speaker on IT, cybersecurity and digital forensics and he has co-authored 14 books published by the American Bar Association. He can be reached at mmaschke@senseient.com.
Sharon D. Nelson, Esq., is the President of Sensei Enterprises, Inc., a digital forensics, cybersecurity and information technology firm in Fairfax, Virginia. Ms. Nelson is the author of the noted electronic evidence blog, Ride the Lightning and is a co-host of the Legal Talk Network podcast series called “The Digital Edge: Lawyers and Technology” as well as “Digital Detectives.” She is a frequent author (eighteen books published by the ABA and hundreds of articles) and speaker on legal technology, cybersecurity and electronic evidence topics. She was the President of the Virginia State Bar June 2013 – June 2014 and a past President of the Fairfax Law Foundation and the Fairfax Bar Association. She may be reached at snelson@senseient.com
1 min read
Who finds the business serviced by a law firm? Lawyers. Who minds the business serviced by a law firm? Lawyers. Who grinds the business serviced by...
Remember the Golden Ticket from Willy Wonka? A lot of lawyers thought they had discovered a golden ticket when they discovered ChatGPT. They were...
3 min read
What We Learned in 2021 In December 2021, Dave Ries, a frequent co-presenter with the authors, wrote an excellent summary of the cybersecurity...