Ride The Lightning: SANS Suffers Data Breach After Phishing Attack

When I used to do more computer security-related work, my go-to resource was the SANS Institute. It’s discouraging but educational that even top pros like them can fall for a phishing attack.

Phishing attacks are probably the most serious computer security threat out there now.

Dennis and Tom in a recent Kennedy-Mighell podcast noted a recent example that tended to show training employees had only limited benefits. Testers sent simulated phishing emails to a firm’s employees after they had been warned that such a test might be performed. Nevertheless, nearly all the employees fell for the phony emails.

Nevertheless, it’s foolish not to at least attempt to attempt to educate your employees. If it prevents even one incident that otherwise might result in ransomware or worse, it would be worth it.

Threatpost has some other suggested defensive tips.


Marketing On The Horizon Productivity Tips

Seth Grodin: Selling Results

Good insight here from Seth Grodin for lawyers willing to try something different:

“We don’t pay surgeons by the hour. […] When you sell your time, you’re giving away your ability to be a thoughtful, productivity-improving professional. Sell results.”

H/T to Mary Ellen Bates.

COVID-19 Marketing Presentation Tips

Presentation Tip 12: Online Presentations Intro & Camera Selection

Everyone understands why online presentations have become more important than ever. This is the first in our series of online Presentation Tips. We invite you to travel along with us.

Selected Resources

Here are a few of the better resources we’ll be discussing:

  1. Top Tips & Tools for Better Online Presentations
  2. Video & Audio Quality Matter — Make Your Remote Work More Professional

The first order of business for online presentations is deciding on your level of ambition. Tom Mighell summaries the issue concisely at the Kennedy-Mighell Report podcast:

So what do you want? Do you want a professional setup for talking to clients or colleagues? Do you want a more polished setup to record videos for YouTube or other services? I think the purpose that you have is going to determine the kind of setup that you have got. And I tend to agree with you, if you want something that’s more professional, more polished, if you tend to want to make more of what you are going to be doing with this, what you have likely is not going to work.

Video Quality

Dennis Kennedy‘s followup provides a perfect example for the ambition issue: Use the camera built into your laptop only if you don’t care about quality.

Cameras are typically not a primary consideration for laptop purchasers, so manufacturers tend to use very cheap cameras. What if you are more ambitious?

  • Cameras in smartphones or tablets provide an easy way to get a better result. This may seem counterintuitive, but it makes sense. Since camera quality is a discriminating factor behind mobile device purchases, manufacturers strive to provide higher quality cameras. Mighell observes: “I decided to use my iPad to attend a Microsoft Teams meeting and the quality difference in the camera was 1,000% better on the iPad.” A USA Today affiliate article has some advice.
  • Dedicated high-resolution web cameras are the next step up. Logitech is a reliable brand name. Mighell recommends the Logitech C930, but they are in short supply, and vendors recently have taken advantage of the market to bump up the price. A Google search will find one, or a model of comparable quality.
  • If you are striving for the highest quality, a DSLR (digital single-lens reflex) camera may be your best choice. These are general purpose cameras that can be adapted for online use. They generally have the best quality. The downside is that they can be trickier to set up. Engadget has good advice on the ins and outs.

Microphone selection is similar: Choose the level that best matches your ambition level. More on microphone selection in our next Presentation Tip post.

Productivity Tips

New Dennis Kennedy Book: Successful Innovation Outcomes In Law

Since having the pleasure of working with Dennis Kennedy for three years on The Internet Roundtable, an column about lawyer marketing on the Internet I’m not surprised at the quality of his new book, Successful Innovation Outcomes in Law: A Practical Guide for Law Firms, Law Departments and Other Legal Organizations. It’s now available from Amazon, where it has a four star rating.

Reviews are available from Artificial Lawyer and TechLaw Crossroads. The Kennedy-Mighell podcast contains some of Kennedy’s thoughts on his magnum opus. My preliminary assessment of this important book is at Amazon and I’m working on my own detailed review.

In the meantime, I note what may be the book’s most insightful observation:

 [N]othing can prepare you for the Byzantine politics of a legal organization.

Dennis has well deserved reputation as an expert on legal technology He is also a dynamic speaker, worth considering the next time you are looking for a keynoter.


Working at Home: Security Issues

Digital Detectives, a Legal Talk Network podcast, is one of my favorites. This month hosts Nelson and Simek ( interview David K. Reis, who provides some good advice about working at home security issues. After emphasizing the phishing threat, he pointed out a couple of other risks:

One is security for home printers. If you are going to print confidential client information or other confidential firm information, there can be security issues with the printers storing it, if it’s a wireless printer that isn’t configured securely, someone may be able to intercept that. So printers are a second thing other than the phishing and protection against the usual security threats.

A third one is paper documents. If you are printing confidential law firm or client documents at home what do you do with drafts, what do you do with old ones? We all over our shredding bins and security in the office, don’t just throw it in regular trash at home and we actually did an alert on that earlier before the current one on the importance of paper in cybersecurity during the work-at-home.

Source: Work-At-Home and Remote Access – It’s Time for a Security Review – Legal Talk Network


MIT Technology Review

MIT Technology Review Algorithm Article

Subscribers to the MIT Technology Review get  a nice perk: The Algorithm, a weekly email newsletter about tech trends. It’s an easy way to keep up with important tech developments. A timely article this month: problems with predictive policing algorithms.


Transitioning from Twitter to Blogging

Bob Ambrogi interviewed Lindsay Griffiths, author of Zen & the Art of Legal Networking blog. Sometimes 280 characters just won’t cut it:

Originally, I thought that it didn’t make sense for me to blog. And I didn’t think I had anything to say. But I started on Twitter first and I realized that when I would respond to things that people were saying or questions that people had that I had much more to say than  140 characters at that time permitted me to answer…I started to realize that maybe I did have something to say and I did have a viewpoint that felt valuable and I could interact on a larger platform.


Ransomware: An Instructive Example 

“Ransomware,” or hacker blackmail attempts to extort money by threatening to release confidential/embarrassing information, is on the rise. “Phishing” or its variant, “spear phishing” seem to be the most common vector.

  • “Phishing” is basically spam that contains a poison pill in the form of a trojan horse attachment or link to a drive by download website.
  • “Spear phishing” is the same, except it’s targeted to make it more attractive to a particular organization or even a particular person.

Thanks to Ben Schorr for an interesting example:  The University of California San Francisco paid hackers $1.14 million (after negotiating them down from $3 million). BBC News has a transcript of some of the negotiations.

But Jan Op Gen Oorth, from Europol, which runs a project called No More Ransom, said: “Victims should not pay the ransom, as this finances criminals and encourages them to continue their illegal activities.

“Instead, they should report it to the police so law enforcement can disrupt the criminal enterprise.”

Brett Callow, a threat analyst at cyber-security company Emsisoft, said: “Organisations in this situation are without a good option.

“Even if they pay the demand, they’ll simply receive a pinky-promise that the stolen data will be deleted.

“But why would a ruthless criminal enterprise delete data that it may be able to further monetise at a later date?”

Phishing and is worse than a nuisance: It can destroy your business. Specialized software can help, but the first line of defense is high quality training of your employees. Supplement this by testing their responses to test break-in attempts–and embarrassing the employees who show themselves to be too gullible.

Tech Republic has more tips.


Potential for Attack on Internet Infrastructure

The conventional wisdom is that the resilient nature of Internet protocols makes it difficult or impossible for an attacker to take down or cripple the Internet. A couple of respected Washington Post columnists have some doubts about the conventional wisdom. I think they have a point.

David Ignatius advises:

America’s botched response to the coronavirus pandemic is a warning that, unless our broken political and administrative systems are fixed, the country could experience a similar breakdown in future national crises, such as a massive cyberattack.

This stark message was contained in a little-noticed white paper recently released by the bipartisan Cyberspace Solarium Commission, titled “Cybersecurity Lessons From the Pandemic.” As the paper highlighted, the covid-19 outbreak has been a stress test for our national crisis-management system — and that system has, to a frightening extent, failed. The challenges of a cyberattack would be even greater. …

Part of the problem with our covid-19 response is specific to Trump, who seems to view unpredictability and lack of planning as positive management tools. But another president, with better management skills, would still face bureaucratic blockages that are endemic to our system. White House coordinators similar to the proposed cyber director — the U.S Trade Representative, say, or the Office of Science and Technology Policy — struggle in any administration to frame coherent government-wide policy, as noted in a recent Lawfare essay by Mieke Eoyang and Anisha Hindocha.

Economics columnist Robert J. Samuelson thinks Big Tech’s  privacy/monopoly/abuse of power issues are small potatoes next to the threat of a crippling cyberattack:

The consequences of a massive cyberattack could make the disruptions caused by the pandemic seem like child’s play. There might be simultaneous assaults on the nation’s power, communication, financial and transportation networks. People would stumble about in a cyber fog with public and private communications channels, from email to cable TV, disabled or overwhelmed.


Security Theater and Covid-19

A major Washington DC property management company is putting out guidance on reducing Covid-19 risks.

Some of their recommendations make sense. Taking employee temperatures when they report to work every morning seems reasonable.

Some are dubious. Requiring retesting temperature when employees return from lunch is almost certainly overkill.

IT Security Guru Bruce Schneier

Security theater is not new. Bruce Schneier, a leading IT security expert defined security theater and provided an example in his essay Beyond Security Theater:

“Security theater refers to security measures that make people feel more secure without doing anything to actually improve their security. An example: the photo ID checks that have sprung up in office buildings. No-one has ever explained why verifying that someone has a photo ID provides any actual security, but it looks like security to have a uniformed guard-for-hire looking at ID cards.” [Emphasis added]

Is security theater always bad? To the extent it reduces anxiety, it can be beneficial.

Other benefits are possible. One D.C. law firm decided that even though they could cover everything needed in their Covid-19 safety briefings in 20 minutes, they should last at least an hour.

Wasted time or wise precaution? Not sure, but if the law firm’s seriousness ever came into question, in litigation or otherwise, hour-long sessions might have at least some symbolic value.