Computer Crime: lawyers slated over e-mail practices, lack of anti-spy software and disaster-recovery plans

Law firms are failing to address IT security risks, research revealed this week.


A survey commissioned by digital security specialist Evolution Security Systems (ESS) showed that despite one in ten firms having suffered a security breach in the past year, more than half do not follow basic IT security measures.


More than 50 of the 100 legal practitioners surveyed said they asked colleagues to check their e-mails for them, while a quarter admitted that they never change their 'sign on' password.



Almost four-fifths of respondents saw computer viruses as the greatest threat to digital security, while nearly a third thought organised computer crime was the fastest- growing menace. More than half considered security threats to be on the increase, although the number who had suffered a breach in the past 12 months is the same as the previous year.


More than half of practitioners have not deployed anti-spy software on their computer networks to protect sensitive information, the research revealed, while 40% have no knowledge of disaster-recovery plans for their IT systems. Almost half of respondents said their firm had no dedicated IT digital security budget.


ESS technical director Peter Jackson said: 'Given the sensitive information that law firms are dealing with, it is surprising that so many are only paying lip service to IT security.


'It is normal practice to get others to check their e-mails, even though they may well be some within the folder relating to members of staff or clients that they would not want that colleague to look at. It is also common for passwords to be written down.'


He added: 'The threats to the business are both external and internal, and in some ways internal threats, for example from disgruntled employees, are greater.'


ESS chief executive Ritchie Jeune added: 'UK law firms clearly recognise the type of threats ranged against them, whether computer viruses, hackers or organised criminal gangs. But they are nevertheless failing to take some essential security measures which would address most of those problems. Many respondents also seemed unaware of their organisation's business continuity plans. This is particularly worrying, since most law firms, driven by Lexcel and other accreditations, will clearly be required to have security and other disaster-recovery policies in place over time.'