Slashdot Mirror
Book Review: Locked Down: Information Security For Lawyers
benrothke writes "Had Locked Down: Information Security for Lawyers not been published by the American Bar Association (ABA) and 2 of its 3 authors not been attorneys; one would have thought the book is a reproach against attorneys for their obliviousness towards information security and privacy. In numerous places, the book notes that lawyers are often clueless when it comes to digital security. With that, the book is a long-overdue and valuable information security reference for anyone, not just lawyers." Read below for the rest of Ben's review.
Locked Down: Information Security for Lawyers
author
Sharon Nelson, David Ries, John Simek
pages
319
publisher
American Bar Association
rating
9/10
reviewer
Ben Rothke
ISBN
978-1614383642
summary
Required reading for all lawyers
Such a title is needed as the legal field has embraced digital technology. Wireless (often insecure) networks are pervasive in corporate offices throughout legal America.
The underlying problem is that while attorneys often know the intricacies of tort law, court proceedings and the like; they are utterly unaware of the information security and privacy risks surrounding the very technologies they are using. In many firms, the lawyers think that someone is protecting their data, but don't understand their requirements around those areas of data protection.
Legal IT systems are a treasure trove of personal data. Many small law firms are extremely attractive to identity thieves gives their systems have significant amount of personal information via social security numbers, credit card information, birth dates, financial information and much more. Small law firms are notorious for weak information security controls and attackers will scan those systems and networks for vulnerabilities.
A pervasive aspect of the book is ABA rule 1.6 regarding the confidentiality of information regarding client-lawyer relationships. The rule requires that a lawyer not reveal information relating to the representation of a client unless the client gives informed consent. The lawyer though can reveal information relating to the representation of a client to the extent the lawyer reasonably believes necessary. The myriad details of 1.6 can be left to the bar association to enforce, suffice to say that a lawyer can find themselves on the wrong side of the law if they are not careful with information security controls.
The authors note that although lawyers are all well aware of rule 1.6, the challenge is how to keep client data secure in the digital age. In a world of paper, things were much easier and cheaper This is why the authors note that so many otherwise competent layers fails so miserably in reference to their duty to maintain the confidentiality of digital client data.
The book quotes an ABA 2011 technology survey in which 21% of large law firms reported that their firm had experiences some sort of security breach, and 15% of all firms reported that they suffered a security breach. It is figures like those which show that attorneys really need to read this book and take the information to heart.
The books 17 chapters are in a readable 150 pages, with an additional 120 pages of appendices. Written in an easily understandable style and non-technical for the technologically challenge lawyer.
When it comes to the security of client data, in chapter 4 the authors write that encryption is a topic that most attorneys don't want to touch with a ten-foot pole. But it has reached a point where attorneys must understand how and when encryption should be used. Just as important, they need to know about key managements, and what good encryption is. The chapter provides a high-level detail on what needs to be done regarding encryption.
Chapter 13 is on secure disposal, is an important topic to everyone, and not just lawyers. Digital media needs to be effectively disposed of; and for many lawyers, they often think that means reformatting a hard drive or simply erasing files. The chapter effectively details the issues and offers numerous valuable hardware and software-based solutions.
Chapter 14 on outsourcing and cloud computing is an area where too many attorneys are oblivious to of the security and privacy risks. For example, the authors advise attorneys against the use of the free Gmail service since the terms of service allow Google to do anything it wants with the data. That opens a Pandora's Box when it comes to securing client data. The authors advise to use premium Google business versions, so attorneys can stay in control of their data with added security and privacy features.
Two omissions in chapters 13 and 14 are that the authors don't reference NAID (National Association for Information Destruction) or the CSA (Cloud Security Alliance (CSA).
Firms that outsource their digital disposal to non-NAID certified firms run the risk of having a glorified recycler do their work. As to NAID, it is an international trade association for companies providing information destruction services. NAIDs mission is to promote the information destruction industry and the standards and ethics of its member companies; while the mission of the CSA is to promote the use of best practices for providing security assurance within cloud computing and to provide education on the uses of cloud computing to help secure all other forms of computing.
The authors include many real-world stories and case law to reinforce their point.
The book closes with a number of appendices on various rules from the FTC, state information protection regulations, the SANS Institute glossary of security terms and more.
For the lawyer looking for an easy to read introduction to nearly everything they need to know about information security and privacy, the book is a great resource.
The book closes with the note that since lawyers have an ethical duty to protect their client's data, they have no choice but to keep themselves as well educated as possible.
For the attorney that wants to ensure their requirements remain current and are looking for an easy to read introduction about information security and privacy Locked Down: Information Security for Lawyers should be considered required reading.
Reviewed by Ben Rothke.
You can purchase Locked Down: Information Security for Lawyers from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
The underlying problem is that while attorneys often know the intricacies of tort law, court proceedings and the like; they are utterly unaware of the information security and privacy risks surrounding the very technologies they are using. In many firms, the lawyers think that someone is protecting their data, but don't understand their requirements around those areas of data protection.
Legal IT systems are a treasure trove of personal data. Many small law firms are extremely attractive to identity thieves gives their systems have significant amount of personal information via social security numbers, credit card information, birth dates, financial information and much more. Small law firms are notorious for weak information security controls and attackers will scan those systems and networks for vulnerabilities.
A pervasive aspect of the book is ABA rule 1.6 regarding the confidentiality of information regarding client-lawyer relationships. The rule requires that a lawyer not reveal information relating to the representation of a client unless the client gives informed consent. The lawyer though can reveal information relating to the representation of a client to the extent the lawyer reasonably believes necessary. The myriad details of 1.6 can be left to the bar association to enforce, suffice to say that a lawyer can find themselves on the wrong side of the law if they are not careful with information security controls.
The authors note that although lawyers are all well aware of rule 1.6, the challenge is how to keep client data secure in the digital age. In a world of paper, things were much easier and cheaper This is why the authors note that so many otherwise competent layers fails so miserably in reference to their duty to maintain the confidentiality of digital client data.
The book quotes an ABA 2011 technology survey in which 21% of large law firms reported that their firm had experiences some sort of security breach, and 15% of all firms reported that they suffered a security breach. It is figures like those which show that attorneys really need to read this book and take the information to heart.
The books 17 chapters are in a readable 150 pages, with an additional 120 pages of appendices. Written in an easily understandable style and non-technical for the technologically challenge lawyer.
When it comes to the security of client data, in chapter 4 the authors write that encryption is a topic that most attorneys don't want to touch with a ten-foot pole. But it has reached a point where attorneys must understand how and when encryption should be used. Just as important, they need to know about key managements, and what good encryption is. The chapter provides a high-level detail on what needs to be done regarding encryption.
Chapter 13 is on secure disposal, is an important topic to everyone, and not just lawyers. Digital media needs to be effectively disposed of; and for many lawyers, they often think that means reformatting a hard drive or simply erasing files. The chapter effectively details the issues and offers numerous valuable hardware and software-based solutions.
Chapter 14 on outsourcing and cloud computing is an area where too many attorneys are oblivious to of the security and privacy risks. For example, the authors advise attorneys against the use of the free Gmail service since the terms of service allow Google to do anything it wants with the data. That opens a Pandora's Box when it comes to securing client data. The authors advise to use premium Google business versions, so attorneys can stay in control of their data with added security and privacy features.
Two omissions in chapters 13 and 14 are that the authors don't reference NAID (National Association for Information Destruction) or the CSA (Cloud Security Alliance (CSA).
Firms that outsource their digital disposal to non-NAID certified firms run the risk of having a glorified recycler do their work. As to NAID, it is an international trade association for companies providing information destruction services. NAIDs mission is to promote the information destruction industry and the standards and ethics of its member companies; while the mission of the CSA is to promote the use of best practices for providing security assurance within cloud computing and to provide education on the uses of cloud computing to help secure all other forms of computing.
The authors include many real-world stories and case law to reinforce their point.
The book closes with a number of appendices on various rules from the FTC, state information protection regulations, the SANS Institute glossary of security terms and more.
For the lawyer looking for an easy to read introduction to nearly everything they need to know about information security and privacy, the book is a great resource.
The book closes with the note that since lawyers have an ethical duty to protect their client's data, they have no choice but to keep themselves as well educated as possible.
For the attorney that wants to ensure their requirements remain current and are looking for an easy to read introduction about information security and privacy Locked Down: Information Security for Lawyers should be considered required reading.
Reviewed by Ben Rothke.
You can purchase Locked Down: Information Security for Lawyers from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
How many times have we seen 'redacted' legal documents as a PDF with black bars overlaying the text? (See Groklaw for past examples.)
1. Open the PDF in Acrobat Reader.
2. Select All
3. Copy
4. Switch to text file editor (not Edlin!)
5. Paste
. . . .
6. Profit?
Does this demonstrate a failure in understanding information security?
I'll see your senator, and I'll raise you two judges.
I always carefully add:
"Confidentiality: The information contained in this e-mail is intended only for the
personal and confidential use of the designated recipients of the email. This message
may be an attorney-client communication and, as such, is privileged and confidential. If
you are not an intended recipient of this message or an agent responsible for delivering
it to an intended recipient, you are hereby notified that you have received this message
in error, and that any review, dissemination, distribution, or copying of this message is
strictly prohibited. If you have received this message in error, please delete it and all
copies and notify us immediately by reply e-mail or by telephone"
To the signature section of all my emails. Surely that qualifies as due-diligence concerning information security?
I'll surmise that from a lawyer's point of view, information security is just another "feature" or "service" to take for granted (just like electricity or water). If any confidential information is lost, it is the _client_ who's injured, and hey, the lawyer will be happy to help the client sue whoever for absurd sums of money (for a small consideration, of course..).
I post this having not read a single page of this book. I was interested in getting this book for my attorney wife. When looking at it on AMAZON.COM, I noticed that the post here is a copy of only ONE of TWO reviews the book has on Amazon.com. The other review is HORRIBLE. http://www.amazon.com/Locked-Down-Information-Security-Lawyers/product-reviews/1614383642/ref=cm_cr_dp_qt_hist_one?ie=UTF8&filterBy=addOneStar&showViewpoints=0 Read/order with caution.
I post this having not read a single page of this book. I was interested in getting this book for my attorney wife. When looking at it on AMAZON.COM, I noticed that the post here is a copy of only ONE of TWO reviews the book has on Amazon.com. The other review is HORRIBLE. http://www.amazon.com/Locked-Down-Information-Security-Lawyers/product-reviews/1614383642/ref=cm_cr_dp_qt_hist_one?ie=UTF8&filterBy=addOneStar&showViewpoints=0 Read/order with caution.
As someone who occasionally writes reviews for Slashdot (and usually reads all of the ones posted), this is a clear violation of the book review guidelines:
First, an important one: by submitting your review to Slashdot, you represent that the review is your own work, that it is original to Slashdot, and that it is unencumbered by any existing or anticipated contractual relationship; further, you are granting Slashdot permission to publish your review, including any editing the Slashdot editorial team finds necessary and appropriate. (Major edits will involve consultation by email or other means.) If you've reviewed the book elsewhere anywhere besides a personal home page (for instance, on Amazon) please be sure that your review for Slashdot is substantially different.
(emphasis mine) There is no difference that I can see ...
My work here is dung.
Sorry to respond to my own comment but for Ben Rothke it looks like he just reposts his Amazon reviews here:
...
Book Review: The Plateau Effect: Getting From Stuck To Success is identical to this Amazon review.
Book Review: The Death of the Internet is identical to this Amazon review.
Book Review: Everyday Cryptography is identical to this Amazon review.
Book Review: Liars and Outliers is identical to this Amazon Review.
It just keeps going
My work here is dung.
The reviewer's Web site and LinkedIn profile both state "I review and recommend books on digital security, privacy and other relevant issues and write a monthly book review on topics of information security and privacy for Security Management magazine and Slashdot."
The reviewer reviews IT books on Amazon like clockwork, almost always 7 or 8 days between reviews, which are always positive, written like marketing material and always give 4 or 5 stars:
May 20, 2013 Locked Down: Information Security for Lawyers 5 Stars
May 13, 2013 The Plateau Effect: Getting from Stuck to Success 4 Stars
May 7, 2013 Secure Coding in C and C++ (2nd Edition) (SEI Series in Software Engineering) 5 Stars
May 1, 2013 Cybersecurity: Public Sector Threats and Responses (Public Administration and Public Policy) 4 Stars
April 22, 2013 Applied Information Security: A Hands-on Approach 4 Stars
April 15, 2013 The Death of the Internet 5 Stars
April 8, 2013 Applied Cyber Security and the Smart Grid: Implementing Security Controls into the Modern Power Infrastructure 4 Stars
March 28, 2013 Introduction to Computer Networks and Cybersecurity 4 Stars
March 20, 2013 Managing Risk and Information Security: Protect to Enable 4 Stars
(362 Reviews total)
There's a theme in his reviews of either saying that the book is a must-read for _____, or suggesting that the only people who won't get a lot out of the book are people who don't understand how much they need it: "For the reader who may be indifferent to their need for change, the book may not be of full value to then." And "The only negative thing about the book is the over the top title, which I think detracts from the important message that is pervasive in it."
I attended an information security conference last year that had a prominent attorney speaking regarding information security. His biggest message to all of us was that he wanted to see more information security professionals consider becoming attorneys, as there was a serious shortage in experts in both security and the law. He said that his major issue is that there is a lot of bad law and bad precedent out there and he would like to see that change. I suppose this book is just a case in point of that argument. If there is a systemic issue of attorneys not being security-aware and not protecting their data and the data of their clients, how can we expect them to be able to argue before the courts and help create proper, forward-looking precedents?
Those disclaimers are worthless!
No, they're just mostly worthless. Attorneys in some states have ethical duties to delete confidential material they receive by accident, or to notify the sender, or to take other actions. The disclaimers can be useful if (1) they are in a state where their obligation to destroy received material only accrues when they are told to do so, or (2) to show a judge that they didn't do what they were bound to do and they knew they should have, because (a) not only is it in the state ethics rules but (b) it actually TELLS THEM to destroy it.
For example.
My, how I've become irate over the years with medical practitioners having such lax (nay, absent) IT security policies.
I'm sick of doctors installing random software off the internet.
I'm sick of doctors connecting their computers directly to the internet, with nothing but Windows as protection.
I'm sick of doctors throwing unencrypted DVD back-up's in their trash.
The list goes on ...
We have to include scads of attorneys in every security incident. They grab 90% of the oxygen in the room, rattle off endless questions and NEVER EVER bring anything to the table. All they ever do is demand draft communications documents for the customer and then relentlessly and obsessively red line everything including the few fragments they themselves offered. After about 9 or 10 iterations of this the lawyers play the passive aggressive game and mumble "do whatever you want!".
Don't you love it when the 3 people leading your meeting are lawyers who, when you ask them for anything, the first thing they say is "Well I'm not technical so I can't say." BUT YOU JUST DID SAY, YOU FUCKING SHITHEAD. IN FACT ALL ANYONE HAS DONE FOR THE PAST 90 MINUTES IS LISTEN TO MICROMANAGE.
Die die die die cut all their heads off on Youtube every last one.