Cybersecurity Statistics In 2024: Is Your Law Firm Protected?

Ed. word: That is the newest within the article sequence, Cybersecurity: Suggestions From the Trenches, by our associates at Sensei Enterprises, a boutique supplier of IT, cybersecurity, and digital forensics providers.

2024 State of the Phish

Perhaps it’s a unusual title, however we positive take pleasure in perusing this report from Proofpoint yearly. The inspiration of the report is a survey of seven,500 finish customers and 1,050 safety professionals. This 12 months’s report signifies that 71% of customers confessed that they had taken a dangerous motion, reusing or sharing a password, clicking on hyperlinks from senders they didn’t know, or giving log-in credentials to somebody they didn’t know. Ninety-six p.c of them knew they have been taking a danger. If this doesn’t persuade you that your staff want cybersecurity consciousness coaching at the very least yearly, we don’t know what is going to!

Over 1 million assaults are launched with MFA (multifactor authentication) bypass framework Evil Proxy each month, however 89% of safety professionals imagine MFA provides complete safety in opposition to account takeovers. Our personal view is that, whereas MFA shouldn’t be an entire resolution, it is much better than NOT having MFA – and the safer your MFA is, the higher.

Sixty-nine p.c of organizations have been contaminated by ransomware. It stays a plague. Any dimwit should purchase a Ransomware-as-a-Service toolkit for round $35 and wreak havoc.

Classes Realized from the State of the Phish

One of the crucial beneficial classes is that with most cybersecurity consciousness trainings (and fortunately, 99% of respondents stated that they had such coaching), lower than a 3rd of their coaching packages coated all “the massive three” – distant work, password hygiene, and web security.

The highest coaching subjects have been malware, Wi-Fi safety, ransomware, and e-mail phishing – that are all essential, however they don’t cowl the complete vary of dangers. The place was phishing utilizing SMS texts? The place was the usage of deepfake audio and video? The place was the social engineering of staff?

Solely 34% of respondents carried out simulated phishing assaults, which stunned us. Simulating phishing assaults are very useful, not solely in educating staff, however in pinpointing the staff whose habits is most dangerous.

The New Risk Panorama

Unsurprisingly, most of the assaults have been phishing, enterprise e-mail compromise (BEC), and ransomware. All are a unbroken drawback, little doubt of that.

However we now have rising threats to deal with. One is telephone-oriented assault supply (TOAD) the place a message seems benign, containing solely a cellphone quantity and a few inaccurate info. When the sufferer calls the listed quantity for assist, the assault chain is activated.

Relaxation assured that cybercriminal name facilities function world wide, persuading victims to grant them distant entry, reveal delicate info and credentials, and even infecting their organizations with malware. Proofpoint’s information reveals that a median of 10 million TOAD messages are despatched every month.

Growing assaults used superior methods to bypass MFA. How do they work? They use proxy servers to intercept MFA tokens, which permits assaults to evade the safety supplied by one-time codes and biometrics. This can be a enormous drawback as a result of 89% of cybersecurity professionals nonetheless consider MFA as a “silver bullet” in stopping account takeovers.

Lastly, there was a rise in the usage of QR codes (for the file, we now have preached for years that you simply by no means actually know the place you’re going if you happen to click on on a QR code). We predict it’s getting worse partially as a result of so many individuals click on on QR codes on a regular basis. They merely don’t see the hazard. Clicking on a QR code could result in a phishing web site or a malware obtain.

AI is Now A part of the Risk

Synthetic Intelligence (AI) facilitates cyber-attacks. To start with, you’re much less more likely to see all of the spelling errors and misuse of grammar. Are all of the AIs clear about what occurs to the info you enter? Usually, they don’t seem to be.

There’s now a hyperlink between BEC assaults and AI, as attackers use AI to create extra convincing and personalised emails in lots of languages. Proofpoint’s information reveals a median of 66 million focused BEC assaults each month.

Any Extra Dangerous Information?

Certain! Whereas Microsoft is probably the most abused product in malicious e-mail, different corporations with the identical drawback embrace Adobe, DHL, Google, AOL, DocuSign, and Amazon. We now have been notably affected by phishing emails purporting to return from DocuSign and Amazon.

And our previous “buddy” ransomware continues to be a serious challenge – 69% of companies (up 5% over final 12 months) confronted a ransomware assault. Of those that had a ransomware assault, 96% now have cyberinsurance, which definitely means that cyberinsurance is a necessity for all companies, together with regulation corporations.

Ultimate Phrases

From the venerable cybersecurity professional Brian Krebs: “When you didn’t go on the lookout for it, don’t set up it.” – a wonderful rule of security.

Sharon D. Nelson (snelson@senseient.com) is a practising lawyer and the president of Sensei Enterprises, Inc. She is a previous president of the Virginia State Bar, the Fairfax Bar Affiliation, and the Fairfax Regulation Basis. She is a co-author of 18 books revealed by the ABA.

John W. Simek (jsimek@senseient.com) is vice chairman of Sensei Enterprises, Inc. He’s a Licensed Info Techniques Safety Skilled (CISSP), Licensed Moral Hacker (CEH), and a nationally recognized professional within the space of digital forensics. He and Sharon present authorized expertise, cybersecurity, and digital forensics providers from their Fairfax, Virginia agency.

Michael C. Maschke (mmaschke@senseient.com) is the CEO/Director of Cybersecurity and Digital Forensics of Sensei Enterprises, Inc. He’s an EnCase Licensed Examiner, a Licensed Laptop Examiner (CCE #744), a Licensed Moral Hacker, and an AccessData Licensed Examiner. He’s additionally a Licensed Info Techniques Safety Skilled.