Lexel – Resurrections and Second Comings

Lexcel and ISO27001 still enjoy a good relationship. Here, Advent IM Security Consultant, Steve Foley, has a look at the updated Lexcel…

A number of years ago a colleague published a blog addressing the ‘Rumoured’ death of Lexcel. The title to that piece was a little tongue in cheek as the content actually pointed to the continued increase in uptake of the accreditation within legal practices. Looking at present day and figures published by the Solicitor’s Regulation Authority and the Law Society suggest that of the 10,393 (May 2018) law firms registered in England and Wales 1,732, some 16 percent are accredited to Lexcel as a standard. As Information Security Consultancy is one of our core business deliverables, the blog continued to cover the correlation between that quality management standard and how it mapped across to a number of clauses within the globally recognised ISO/IEC 27001 – Information Security Management System.
Well here we are in July 2018 and the latest Lexcel Quality Management System publication has arrived to allow firms to consider and manage the impact of the following regulations and Act upon their business;
• The General Data Protection Regulation (Regulation (EU) 2016/679);
• The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017;
• The European Union Financial Sanctions (Amendment of Information Provisions) Regulations 2017; and
• The Criminal Finances Act 2017.
Although the standard launched last month, members of the law society applying for initial or re-accreditation will not be assessed against the new standard until November of this year to allow time for policies to be updated and to be embedded within organisational business as usual.
Certification to recognised standards is becoming increasingly relevant to service providers as organisations look to outsource more and more of their business. As part of due diligence and adherence to relevant regulation, the level of assurance that certification can provide, certainly becomes a business enabler in assisting the tender process.
Also, customers are now savvier in regard to Data Privacy Regulation following the introduction of GDPR this May, the increase of and reporting of data breaches throughout large organisation’s and the no doubt soon to follow headline grabbing data breach fines somewhere throughout the EU. This will no doubt have an impact on which organisations the more astute choose to do business with.
On the subject of GDPR or more appropriately the UK implementation, the Data Protection Act 2018, the application of a management system will help address a number of articles contained within and will demonstrate a strong attitude to Data Privacy, Information Security and the continual improvement of such areas that in turn would help organisations be compliant against such legislation and reduce the threat of an incredibly hefty monetary charge from the ICO.
Whilst they do not marry up entirely, a large number of the requirements of Lexcel do map to ISO/IEC 27001, this relationship between the two standards will be strengthened later this year with the introduction of ISO/IEC 270552 – Enhancement to ISO/IEC 27001 for privacy management.
The overall take away is to choose a suitable standard to certify against as the benefits must be considered to outweigh the risk of having nothing in place. The benefit of demonstrably setting your organisation apart from other legal practices within the country, demonstrating that the sensitive nature of the data you hold is recognised and you treat it safely and securely and being certified to a recognised standard will allow you to tender for numerous contracts where certification is a pre-requisite.


Some top security tips that ALL employees can use

Advent IM

When it comes to security, one thing is clear, people occasionally do daft things with computers and devices, and they frequently do these daft things at work. They occasionally do malicious things too but it’s mostly just daft. So we can train our employees (including managers and directors) in our procedures and policies and enforce them. In fact, spending as much time thinking about the best way to train different teams is never time wasted because it gives you the chance to use their language and create something nuanced that will make a genuine difference, which is, after all, the whole point of doing it.

Looking at some of the data that came out of Vormetric’s Insider Threat report, in actual fact, those privileged users are still posing a security headache to many of the respondents. They may be System Admins or senior colleagues who are simply not restricted or…

View original post 512 more words

Data Protection Day 2016!

Advent IM

As it is Data Protection Day, we thought we would take a look at the current state of play when it comes to business impact from data breach and its not pretty reading…

With increasing levels of data being collected every year, now more than ever we need to ensure very high quality processes and practice in our businesses. It is certainly not something to be taken lightly and the changes to EU DP regulations which could result in penalties of  5% of global turnover for serious data breaches, it could actually mean some of the worst offenders face a very uncertain future.

If you are unsure or need some support with Data Protection, don’t leave it to chance; get some proper guidance. Data Protection done well can be a business-enhancing function; raising everyone’s game and awareness of security. It can also mean closer examination of the need to keep all…

View original post 30 more words

Cyber (Information) security challenges that face Solicitors (and any other type of law firms)

With thanks to one of our highly experienced, Senior Security Consultants, Mark Jones…

istock_000011991144medium.jpgTraditionally in our experience law firms, such as solicitors, have relied on compliance with Lexcel regulations, and the Data Protection Act, to provide adequate security measures to combat threats from say typically malicious insiders or burglars to their attractive data and information databases. In these days of cyber-based threats these traditional defences are clearly inadequate to deal with far more complex and persistent threats posed by external individuals and groups (such as Serious and Organised Crime) that have far more capability and motivation than ever before out in the Internet. Perhaps this is due to increased (or in many cases new) connectivity of law firm systems to being online 24/7 to the outside world and the additional threats that it poses and typically no single individual within the business having responsibility for information security? It is certainly the case that attacks on law firms are on the increase including  for example, scam ‘mandate frauds’ where a fraudster impersonates a known contact, such as a bank or a client, and asking the law firm employee to change the sort code and account number, either for making a known payment (e.g. in a conveyancing transaction) or else, ‘to safeguard the client account against a fraud’. Monies will then leave the business account and go to an account controlled by the fraudster and the liability of the financial loss will normally be with the Solicitor say for authorising the changes[1].

Advent IM HMG accreditation concepts trainingThe need for robust and effective cyber security controls for small to medium sized business including legal firms has been recognised by Government’s National Cyber Security Strategy with their recent investment in a wide range of supporting measures, including:

  • A Cyber Incident Response (CIR) service – to provide help after the attack (and you will be attacked, not a question of if, but when);
  • Cyber Essentials – a cybersecurity assessment to provide assurances to other business stakeholders;
  • ICO’s IT Security Top Tips – to help ensure compliance with Principle 7 of the DPA98 in securing personal information; and
  • Government Guide – for small businesses ‘What you need to know about cybersecurity’.

Also, it is good to see that the Law Society itself has not been standing still and recognises the significant threats to its members with initiatives such as:

  • Cyber Security for Legal and Accountancy Professionals – a one hour online awareness course developed by the Government with the support of the Law Society and ICAEW; and
  • Law Society sponsorship to join the Cyber Security Information Sharing Partnership.

iStock_000014878772MediumAll of these initiatives and measures are good in increasing awareness of the risks that solicitors and other law firms face but at the same time the businesses themselves must think seriously about how they can continuously mitigate the increasing cyber threat by ensuring that they have implemented best security practices such as appointing senior management / partners with a specific responsibility for all security matters including the traditional physical and personnel measures but now expanded to include organisational, policy and procedures, IT operations and communications, 3rd party service providers, security incident management and more besides. Compliance with Cyber Essentials is a must for all businesses especially small businesses (for suppliers to Government it is mandatory) but for the medium-sized and above business it may be time for them to contemplate implementing a more robust and comprehensive information security management system or framework as provided by the International Standard Organisation’s ISO27001:2013. Law firms that Advent IM have engaged with to provide

quality standard

mentoring support, guidance and advice to eventual certification have acknowledged the competitive advantage it provides as currently there are not many law firms certified to the ISO. More importantly, Partners are re-assured that their business has now the correct Governance, Risk and Compliance (GRC) management processes in place to face the increasing and ever more dangerous threats from Cyber Crime. It is appreciated that many legal SMEs don’t have the necessary subject matter expertise within the practice and that is where Advent IM excel by providing that aspect and having worked with other law firms to understand their business practices and how better cyber security can support their legal business processes.

[1] Source: http://www.lawsociety.org.uk/News/Stories/scams-against-solicitors-met-police-offer-advice-and-support-on-fraud-prevention/

Security Predictions for 2016

Advent IM

As 2015 draws to a close, we asked the Advent IM Staff to ponder the challenges for next year. 2015 saw some huge data and security fumbles and millions of people had their personal information exposed as hack after hack revealed not only how much this activity is on the increase, but also how  the security posture of some businesses is clearly unfit for purpose.

Over to the team…

Image courtesy of Vlado at FreeDigitalPhotos.netVlado at FreeDigitalPhotos.net

Dale Penn – I predict that with the recent introduction of Apple Pay and Google’s Android Pay we will see a large upswing in mobile device targeted attacks trying to get at our bank accounts.

Del Brazil – Attacks will be pushing in from the Siberian peninsular coupled with additional attacks from the orient- this will bring a chill to the spines of organisations.  These attacks are likely to be followed by sweeping phishing scams from the African continent.  There is…

View original post 678 more words

Internet Explorer: Jan 12th will bring some changes…

Advent IM

A post from Advent IM Security Consultant, Chris Cope. 

Do you use Microsoft Internet Explorer?  Are you using a version of Windows older than 8.1?  If the answer to these questions is yes ,or even don’t know, then you need to keep on reading.

On 12 January 2016, Microsoft will only provide security updates to Internet Explorer 11; previous versions will no longer be supported.  Version 11 is the last release of Microsoft’s long running Internet Explorer browser, with Microsoft Edge now supplied by default on newer versions of Windows, version 10 onwards.  Internet Explorer 11 was made available for Windows 8.1 on 17 October 2013 and on 7 November 2013 for Windows 7, but for users who have been running Windows 7 for some time, an older version  of Internet Explorer may be installed, which could include versions 8, 9 and 10.  If you are using Microsoft Vista, or…

View original post 415 more words

Round-up: Top posts of 2015

Advent IM

2015 is almost over and we have been pleased and delighted to welcome many new followers and contributors to the Advent IM Holistic Security blog. It’s hard to wade through all the content but we thought it would be nice to present you with a list of some of our most popular posts this year, by month. (This is based upon what people read and not necessarily when they were published.)

jAN 2015In January, we warned you to watch out for phishing emails if you had nice shiny new devices for Christmas. We were recognised as Cyber Security Solution Suppliers to Her Majesty’s Government and we enjoyed a visit from The Right Honourable Francis Maude to talk all things CyberSec.

In FFEB 2015ebruary, we had a visit from James Morrison MP to talk about how cyber attacks affect local and national businesses, we launched Whitepaper on CCTV in schools and discussed the…

View original post 727 more words

TalkTalk advised not to talktalk about their breach?

Advent IM

According the International Business Times, the Metropolitan Police advised TalkTalk not to discuss their breach. (you can read the article here)

Here, in conversation on the topic , is Advent IM Directors, Julia McCarron and Mike Gillespie and Security Consultant, Chris Cope.

Chris Cope small headshot Chris Cope

“This is interesting as it shows the 2 different priorities at work.  For the police, the key aim is to catch the perpetrator.  This often means allowing an attacker to continue so they can be monitored on the network and their activities logged and traced without causing them to suspect that they are being monitored in such a way.  The Cuckoos Egg details how the Lawrence Berkeley Lab famously did just this in response to a hack of their system.  However, TalkTalk have a duty of care to their customers.  If personal information could be used to steal money, then they must weigh up the…

View original post 434 more words