Close
Enter your
text here

Security

Ten Items to Keep in Mind When Considering Cloud Providers: Cybersecurity Best Practices

In my webcast discussion with Tom O’Connor yesterday, we had a terrific discussion of several pros and cons of both on-premise and off-premise (cloud) eDiscovery technology solutions as well as other factors to consider.  If you missed the webcast, you can check it out here.

While we talked about advantages of each approach, we also discussed how your overall eDiscovery solution could include both on-premises and cloud-based tools and mechanisms for a “best of breed” approach to meeting your eDiscovery needs.

But, if you’re considering a cloud solution, how do you know whether the solution(s) you’re considering have the security mechanisms your organization needs?

Earlier this week, Rocket Matter published an interesting post (written by Larry Port) that discussed vetting your cloud providers that might provide some insight.  While the article provided a link to the security standards developed by the Legal Cloud Computing Association (LCCA), it also provided a succinct list of ten items to address with your cloud provider to ensure that the provider can meet your needs.  Here they are:

  • You should own your data. The cloud provider should not own it.
  • You should be able to get your data out of a cloud system at any time in a usable format.
  • Encryption should be used to safeguard client information.
  • The cloud provider should be able to spell out their backup policies.
  • You need to determine who at the cloud provider has access to see your data and under what circumstances. You must be comfortable with the answer.
  • Find out if the company has had a breach before. If so, how did they respond to it?
  • What measures does the cloud company take to ensure cybersecurity on an operational level? In other words, aside from the application you’re spending money on, is the organization itself safe? Do they conduct background checks on employees? How do they manage passwords internally?
  • Does the application limit attempts to log in to prevent brute force and dictionary attacks?
  • Can you use two-factor authentication?
  • How does the company handle data destruction? It is important when you leave a service that copies of your data are not lying around.

This is a terrific list of guidelines to keep in mind when considering cloud providers and it’s a good idea to get an understanding of how they would address each of these areas.

Also, if you’ve been watching the news the past few days, you’ve seen the devastation in my hometown of Houston from Hurricane Harvey.  What can you do to help?  Consider donating online to the Houston Food Bank, Galveston County Food Bank or Corpus Christi Food Bank.  Or the Coastal Bend Disaster Recovery Group.  And, if you’re in the Houston area, you can volunteer at the American Red Cross here or by calling 713-526-8300.  Thanks for your help.

So, what do you think?  How do you evaluate cloud providers?  Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Today’s the Day to Learn Whether an On-Premise or Off-Premise Solution is Right For You: eDiscovery Best Practices

When consumers are considering their eDiscovery technology choices, there are more factors to consider today than ever. In addition to considering the functionality of the software application, you now also have to consider whether to buy or “rent” the application, how the software is delivered to you and whether it’s required to be within your firewall or can be an off-premises solution.

Today at noon CST (1:00pm EST, 10:00am PST), CloudNine will conduct the webcast On Premise or Off Premise? A Look at Security Approaches to eDiscovery.  This one-hour webcast will discuss different on-premise and off-premise eDiscovery solution options and considerations for each. Topics include:

  • Drivers for eDiscovery Technology Solution Decisions Today
  • eDiscovery Industry Market Trends and Their Relation to General Industry Trends
  • What Law Firms are Saying about the Technology
  • What Industry Analysts are Saying about the Technology
  • The Cloud vs. No Cloud Debate
  • Why Not All Cloud Solutions Are the Same
  • A Comparative Approach to eDiscovery Technology
  • Putting a Face on Solutions and Risks
  • Key Components of an eDiscovery Technology Solution

I’ll be presenting the webcast, along with (for the first time) Tom O’Connor, who is now a Special Consultant to CloudNine!  If you follow our blog, you’re undoubtedly familiar with Tom as a leading eDiscovery thought leader (who we’ve interviewed several times over the years) and I’m excited to have Tom as a participant in this webcast!  To register for it, click here.

Also, if you’ve been watching the news the past few days, you’ve seen the devastation in my hometown of Houston from Hurricane Harvey.  What can you do to help?  Consider donating online to the Houston Food Bank, Galveston County Food Bank or Corpus Christi Food Bank.  Or the Coastal Bend Disaster Recovery Group.  And, if you’re in the Houston area, you can volunteer at the American Red Cross here or by calling 713-526-8300.  Thanks for your help.

So, what do you think?  Do you use on-premise, off-premise or a combination for your eDiscovery solution(s)?  Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Thursday’s ILTACON 2017 Sessions: eDiscovery Trends

As noted Monday, Tuesday and yesterday, the International Legal Technology Association (ILTA) annual educational conference of 2017 (otherwise known as ILTACON) is happening this week and eDiscovery Daily will be reporting this week about the latest eDiscovery trends being discussed at the show.  Today is the last day to check out the show at the Mandalay Bay if you’re in the Las Vegas area with a number of sessions available and as many as 215(!) exhibitors providing information on their products and services.

Sessions of interest in the main conference tracks include (all times PT):

9:00 AM – 10:00 AM:

O365 and Exchange Ediscovery Capabilities: While Office 365 and Exchange ediscovery capabilities can make our jobs easier, they can also be subject to problems. What can you expect from these products? In this live demo, you’ll get an interactive tutorial of the features these platforms offer – from the glitz to the glitches.

Takeaways:

  • Understand what the different software offerings are and are not good at
  • Identify gotchas for each product

Speakers include: John Collins, Director of Information Governance & Office 365 Consulting DTI.

Your Perimeter Will Be Breached: Your law firm will be hacked. What do you do when that happens? How do you mitigate the damage done? Join us for a technical discussion on what you can put in place that will help you identify where you have been hacked and how to get rid of the threat.

Takeaways:

  • Determine a list of things to check when you’re back in the office
  • Identify ways to find intruders in your perimeter and mitigate risk

Speakers include: Brian Johnson, Sr. Security Engineer Emergent Networks.

11:15 AM – 12:15 PM:

New Microsoft Features That Will Affect Ediscovery in the Future: Microsoft continues to add features to its products that could make preservation, collection, review and production easier in the future. More and more corporations are using those products. Is it time for law firms to follow suit? Come hear a panel discuss how Microsoft’s legal hold and ediscovery compliance features could change how we deal with ediscovery now and in the future. Will you be prepared to take advantage of these changes?

Takeaways:

  • Learn how Microsoft’s legal hold and ediscovery compliance features are making it easier to deal with ediscovery challenges
  • See how these new features could affect how we deal with edIscovery
  • Discover how to take advantage of these features to further your career

Speakers include: Scott M. Cohen, Managing Director Winston & Strawn LLP; Jake Frazier, Information Governance & Compliance Practice Leader FTI Consulting; EJ Bastien, Lead eDiscovery Program Manager Microsoft Corporation – Legal and Corporate Affairs; Troy Dunham, eDiscovery Program Manager Adobe Systems Legal Department.

2:00 PM – 3:00 PM:

Data Analytics for Information Governance: Whether you’re in a law firm or corporate environment, using data and key metrics can improve your information governance (IG) and system performance. What types of data should you be evaluating, and how to do find the value of it? How can you create the ideal information governance framework by distilling data into building blocks that tie together? We’ll examine case studies to demonstrate data-driven decisions made throughout the building and remodeling of successful IG programs.

Speakers include: Gillian Glass, Director of Practice Support, Paralegals and Records Farella Braun + Martel LLP; Megan Beauchemin, Director of Business Intelligence and Analytics InOutsource; Daniel Holohan, Chief Information Officer The Advisory Board Company.

What’s in YOUR Ediscovery/Litigation Support Strategic Plan?!: Looking into the future, what is the focus of your strategic plan? What are your staff needs and technology needs? Is there company growth? Creating and managing a strategic plan can be difficult, especially as emerging needs fight for resources and attention. This presentation will give ediscovery and litigation support professionals tips on updating, revamping and revisioning their strategic plan. We will also discuss various approaches and timetables for the strategic planning process.

Takeaways:

  • Cultivate ideas on how to develop a strategic plan
  • Identify who needs to be involved
  • Determine factors to consider in your strategic plan

This session will NOT be recorded.

Speakers include: Mary Pat Poteet, Managing Consultant; David Bryant Isbell, Director, Global Practice Support Baker & McKenzie; Ashley Smith, Managing Director Deloitte.

3:30 PM – 4:30 PM:

Preserving, Collecting and Producing Databases for Ediscovery: An industry expert will share how they deal with, manage and produce structured data and databases during litigation and government investigations. Attendees will hear about common challenges and solutions to help deal with these challenging sources of data, and they will learn about techniques to preserve, collect, review and produce structured data and databases.

Takeaways:

  • Learn how to preserve, collect and produce databases
  • Understand common challenges and pitfalls to avoid when dealing with databases
  • Establish a list of questions to ask when dealing with databases

Speakers include: Jim Vint, Managing Director, Practice Lead Global Legal Technology Solutions Navigant.

So, what do you think?  Did you attend ILTACON this year?  If so, what did you think?  Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Wednesday’s ILTACON 2017 Sessions: eDiscovery Trends

As noted Monday and yesterday, the International Legal Technology Association (ILTA) annual educational conference of 2017 (otherwise known as ILTACON) is happening this week and eDiscovery Daily will be reporting this week about the latest eDiscovery trends being discussed at the show.  There’s still time to check out the show at the Mandalay Bay if you’re in the Las Vegas area with a number of sessions available and as many as 215(!) exhibitors providing information on their products and services.

Sessions of interest in the main conference tracks include (all times PT):

9:00 AM – 10:00 AM:

eDiscovery Industry Resources: There are many industry resources for professionals in ediscovery, including Women in eDiscovery, ILTA, ACEDS, EDRM and Sedona. How can you get involved with these organizations, and what are the benefits of becoming a member? Speakers from each organization will share how they can help you and your team.

Takeaways:

  • Gain a better understanding of each organization
  • Learn how to become a member

Speakers include: Amy Juers, Founder & CEO Edge Legal Marketing; Peter Pepiton II, Director of eDiscovery Dinsmore & Shohl; Janelle Eveland Belling, Managing Director of E-Discovery Services & Strategy Perkins Coie; Doug Austin, Vice President of Professional Services CloudNine; Martin Tully, Co-Chair, Data Law Practice Akerman LLP.

Everything You Need to Know About EU General Data Protection Regulation, but Were Afraid to Ask (Until Now): Law firms that deliver services to European Union residents need to be prepared for the new General Data Protection Regulation going into effect May 25, 2018. Discover what you need to know about the GDPR, so you can develop a strategy for reviewing and updating your operations to meet the new obligations. We will also explore technologies available to assist and ways you can secure funding and support from firm leadership.

Takeaways:

  • Understand how to prepare for GDPR compliance
  • Develop a basic plan for implementing GDPR controls
  • Identify resources for GDPR preparation and implementation
  • Understand technology tools available

Speakers include: Ian Raine, Director of Product Management iManage; Jeff Hemming, Product Manager – Marketing Solutions Tikit Inc.; Robert Cruz, Senior Director, Information Governance Actiance, Inc.; Grant Shirk, Vice President, Marketing.

11:00 AM – 12:30 PM:

How to Hack a Law Firm: Many law firm’s conduct external penetration tests, but you can still be hacked. Whether you’ve been through a dozen tests or are facing your first, it’s important to gain insight into the most common ways hackers gain access to a law firm’s data and assets. Learn about the best controls you can put in place to defend against these threats.

Takeaways:

  • Determine a list of top 10 things you need to go back to your firm and check
  • Identify how your firm policies can increase your risk

Speakers include: Kenny Leckie, Senior Technology & Change Management Consultant Traveling Coaches, Inc.

3:30 PM – 4:30 PM:

Automating Information Governance: We’ve all been told that automation is the future of managing and governing information. With automation come many benefits, including rule-based email management, the most sophisticated forms of automated classification and discovery of data’s “meaning.” Interested? Come learn about available technologies, challenges in implementing automation and important lessons information governance (IG) practitioners have learned that can help us put these next-generation tools and techniques to work today.

Takeaways:

  • Discover different techniques to automate solutions to your IG problems
  • Outline what works and what doesn’t
  • Understand why automating IG is worth the investment

Speakers include: Julie J. Colgan, Senior Director, Strategy & Innovation DTI; Leigh Isaacs, Director, Records & Information Governance White & Case LLP; Brianne Aul, Firmwide Senior Records and Information Governance Manager Morgan, Lewis & Bockius, L.L.P.

Ediscovery Data and Records Collaboration: A closed matter is just the beginning to what can often be a complex data storage process. What information gets returned to the client? What data sets get destroyed? What data do you need to keep? From understanding your client’s records retention strategy to having a step-by-step plan with records managers, a collaborative strategy is necessary to ensure records are safeguarded and processes are compliant.

Takeaways:

  • Understand complex data storage methods
  • Comprehend the importance of your clients’ records retention policies and how they affect your retention practices
  • Identify best practices from records managers and general counsel

Speakers include: Brian Jenson, Director, Litigation Support & E-Discovery Services Orrick, Herrington & Sutcliffe LLP; Martin Susec, Assistant General Counsel Nationwide Mutual Insurance; Richard Dilgren, National Director, Data Science & Strategy FRONTEO.

So, what do you think?  Are you planning to attend ILTACON this year?  Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Tuesday’s ILTACON 2017 Sessions: eDiscovery Trends

As noted yesterday, the International Legal Technology Association (ILTA) annual educational conference of 2017 (otherwise known as ILTACON) is happening this week and eDiscovery Daily will be reporting this week about the latest eDiscovery trends being discussed at the show.  There’s still time to check out the show at the Mandalay Bay if you’re in the Las Vegas area with a number of sessions available and as many as 215(!) exhibitors providing information on their products and services.

Sessions of interest in the main conference tracks include (all times PT):

11:00 AM – 12:30 PM:

A Deep Dive into Project Management in Litigation Support: Take a deep dive into advanced litigation support project management (PM) principles. This workshop will be led by three high-level ediscovery strategists and is designed for professionals who live in the trenches of complex litigation support management. Learn principles you can leverage and apply immediately to improve your organization’s PM maturity.

Speakers include: Michael Quartararo, Director of Litigation Support Services Stroock & Stroock & Lavan LLP; Daryl Shetterly, Director, DRS Operations Orrick, Herrington & Sutcliffe LLP

1:30 PM – 2:30 PM:

Managing Data from the EU During Litigation: A panel will discuss current issues and solutions for dealing with data from the European Union during litigation and government investigations. Topics will include certification through Privacy Shield and using Model Clauses in your agreements to address privacy and security concerns.

Takeaways:

  • Learn about the current status of EU data privacy issues
  • Identify how to avoid getting in trouble when dealing with EU data
  • Become comfortable with how the Privacy Shield certification process works

Speakers include: Michael Boggs, Director of Practice Support Holland & Hart; Mollie C. Nichols, Senior Attorney Cleary Gottlieb Steen & Hamilton LLP; Chris Dale, e-Disclosure Consultant E-Disclosure Information Project; Ben Rusch, V.P. Review Solutions – Europe & APA Consilio; Jonathan Wilan, Partner Baker & McKenzie.

3:30 PM – 4:30 PM:

Real-World On-Prem to Cloud Migrations: A panel of peers from firms with experience migrating on-premises systems to the cloud will discuss how their cloud strategies were formed; what moved when and resource allocation; what to look for in a cloud provider; affected business processes; level of effort (time, cost, etc); cloud growth projections; addressing client data audits; and security concerns and challenges. This is a follow-up to Monday’s session on “The Cloud vs. No Cloud Debate.”

Takeaways:

  • Determine things to consider when planning a move to the cloud
  • Gain lessons learned from peers and how to avoid the same pitfalls

Speakers include: Jeffrey Brandt, Chief Information Officer Jackson Kelly PLLC; Christopher P. McDaniel, Chief Information Officer Smith, Gambrell & Russell, LLP; David Tremont, Director, Network Services Bracewell LLP; Moosa Matariyeh, Principal Solutions Architect CDW.

3:30 PM – 5:30 PM:

Litigation Support Roundtable: What major challenges will we face next in litigation support? Gather around this lively, moderated roundtable discussion that will focus on hot topics in industry-wide litigation support and issues to consider for the future. Topics will be selected by session attendees and could include staffing, product selection, technological advances, recent case decisions and outsourcing.

Takeaways include:

  • Experience a lively and timely discussion

Speakers include: Stephen Dooley, Assistant Director of Electronic Discovery and Litigation Support Sullivan & Cromwell LLP; Jack Thompson, Sr. Manager – Litigation Support/Legal Operations Sanofi.

So, what do you think?  Are you planning to attend ILTACON this year?  Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Time for ILTACON 2017: eDiscovery Trends

The International Legal Technology Association (ILTA) annual educational conference of 2017 (known as ILTACON) kicked off yesterday with several networking events, and begins in earnest today with the first day of sessions.  eDiscovery Daily will be reporting this week about the latest eDiscovery trends being discussed at the show.  Over the next four days, we will provide a description each day of some of the sessions related to eDiscovery to give you a sense of the topics being covered.

If you’re in the Las Vegas area, come check out the show at the Mandalay Bay – there are a number of sessions available and as many as 215(!) exhibitors providing information on their products and services.  Sessions of interest in the main conference tracks include (all times PT):

11:00 AM – 12:00 PM:

Challenging ESI Sources: Judge Peck and Craig Ball will discuss the technical and legal issues related to the most challenging electronically stored information (ESI) sources they have dealt with over the past six months in ediscovery. Learn how to prepare and deal with these challenges in your own matters.

Takeaways:

  • Better understand some of the emerging data sources that will become more mainstream in the next several years
  • Identify real-world examples of how to deal with these ESI sources in a defensible way today

Speakers include: Craig Ball, ESI Special Master and Texas Attorney Craig D. Ball, P.C.; Allen McNee, Chief Revenue Officer Integreon; Honorable Andrew J Peck, US Magistrate Judge of New York.

1:00 PM – 2:00 PM:

Latest Trends in Leveraging Analytics in Litigation Support: As the ediscovery industry matures, much has been written and said about the concepts and theories underlying technology-assisted review. How is it being leveraged in practice in 2017, and what’s next on the horizon? Judge Peck and three industry experts will present real-life case studies — some including new applications — and give predictions on the future of advanced analytics in litigation support.

Speakers include: Thomas Barce, Director of Consulting Services KrolLDiscovery; Beth Patterson, Chief Legal & Technology Services Officer Allens; Doug Matthews, Partner Vorys, Sater, Seymour and Pease LLP; Jeremiah Weasenforth, Managing Attorney Team Lead Orrick, Herrington & Sutcliffe LLP Honorable Andrew J Peck, US Magistrate Judge of New York.

The Cloud vs. No Cloud Debate: More and more vendors are moving to cloud models, which can put you in a difficult spot. How do you successfully make the case to move to these cloud solutions? How do you address risk concerns from your firm’s leadership and clients? Can you comply with a client’s “no cloud” demands while leveraging cloud technology? Let’s explore the cloud vs. no cloud debate and prepare you for Tuesday’s session on “Real-World On-Prem to Cloud Migrations.”

Takeaways:

  • Develop a review process for considering cloud solutions
  • Identify features and controls to mitigate risk and make clients happy

Speakers include: Robert DuBois, Chief Information Officer Briggs and Morgan, P.A.

Using the Information Governance Maturity Model: Understanding the defining characteristics of information governance (IG) programs at differing levels of completeness and maturity is a must for your program to be effective.Using the Law Firm Information Governance Symposium (LFIGS) information governance maturity model as a guide, attendees will learn how to identify where you are in different facets of law firm IG maturity and how you can advance your program to the next level.

Speakers include: Brian Donato, Chief Information Officer Vorys, Sater, Seymour and Pease LLP; Dana C. Moore, Manager of Records & Information Compliance Vedder Price P.C.; Terry Coan, Senior Director HBR Consulting LLC.

2:30 PM – 3:30 PM:

Transition Your Litigation Support Career to Cybersecurity and Information Governance: Litigation and practice support specialists are cornering new niches of consultation and expertise in cybersecurity and information governance. While many of the skills and experiences of ediscovery professionals touch on the implications of information governance policies and data security issues, the transition from the litigation support world to another related discipline is not a short and easy path. Success requires significant additional education and certification, an understanding of advanced developing technology proficiencies, and the ability to leverage these areas of high value consulting work from a business perspective. Come hear tips and lessons learned from industry leaders who have incorporated cybersecurity and information governance into their roles.

Speakers include: Caroline Sweeney, Global Director Ediscovery & Client Technology Services Dorsey & Whitney; Rachelle Rennagel, eDiscovery Counsel Pillsbury Winthrop Shaw Pittman LLP; Wale Elegbe, Senior Manager, eDiscovery & Litigation Support Sullivan & Cromwell LLP; Jared Coseglia, Founder & CEO, TRU Staffing Partners, Inc.

4:00 PM – 5:00 PM:

Stand By Me: A Mock 30(b)(6) Deposition of a Corporate IT Representative: Litigation support professionals are often called upon to shepherd client data identification, preservation and collection. Discovery challenges could call into question the integrity and sufficiency of these processes, leading to motion practice and the deposition of a client’s corporate IT representative. In this interactive session, watch as we stage a 30(b)(6) deposition from start to finish and stop along the way to discuss key points and issues you should plan for and be aware of. We’ll also involve the audience to get thoughts and feedback on what you perceive to be the correct course of action.

Takeaways:

  • Understand what to expect during a typical 30(b)(6) deposition
  • Receive tips on how to properly prepare your client by focusing on litigation readiness
  • Learn how to avoid common pain points and errors

Speakers include: Scott B Reents, Lead Attorney, Data Analytics and E-Discovery Cravath, Swaine & Moore LLP; Matthew K. Blaine, Partner Davison Eastman & Munoz, P.A.; George Chiu, Director, Systems Development Prudential Financial, Inc.; Roe Frazer, Attorney, Frazer P.L.C.

The Future of Search in Law Firms: What does the future hold for search in law firms? How far will legal knowledge management push the search envelope beyond documents, matters and expertise? Further than you think! Let’s explore the future of search, including integrating search-enabled applications, broadening the search scope available to the mobile professional, incorporating artificial intelligence, enhanced visualization and the use of predictive analytics, and the use of machine-generated metadata to improve search results. See how search can fulfill its promise of making your lawyers more effective and firm-client relationships more collaborative.

Takeaways:

  • Identify possible search functions
  • Visualize the future of search in your law firm
  • Learn how you can prepare for the future of search
  • Hear Case Studies from two law firms to improve search

Speakers include: Todd Friedlich, Sr. Manager of KM Technology and Innovation Ropes & Gray; Douglas Freeman, Knowledge Systems Manager White & Case LLP; Glenn LaForce, EVP / Chief Strategy Officer Handshake Software; Peter Wallqvist, VP of Strategy iManage.

And, of course, you don’t want to miss the Exhibit Hall Opening Reception from 7:00 PM – 9:00 PM ET, where they’ll “beam you up” into another realm of space and science fiction. As always, this is a great opportunity to visit with exhibitors and tour the Exhibit Hall in a relaxed setting and hors d’oeuvres and beverages will be served.

So, what do you think?  Are you planning to attend ILTACON this year?  Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Retired NIST Expert Says His Advice on Creating Passwords was Wrong: Cybersecurity Best Practices

If you’re a person who takes password security seriously and followed advice to create passwords that use a combination of lower and upper case letters, numbers and special characters to foil hackers, good for you.  Unfortunately, that advice was wrong, according to the National Institute of Standards and Technology (NIST) and the retired expert who authored that advice in the first place.

According to The Wall Street Journal (The Man Who Wrote Those Password Rules Has a New Tip: N3v$r M1^d!, written by Robert McMillan), the author of an 8-page primer written in 2003 which advised people to protect their accounts by inventing awkward new words rife with obscure characters, capital letters and numbers – and to change them regularly – has admitted the advice was largely incorrect.

Back in 2003, as a midlevel manager at NIST, Bill Burr was the author of “NIST Special Publication 800-63. Appendix A.”  The document became a sort of Hammurabi Code of passwords, the go-to guide for federal agencies, universities and large companies looking for a set of password-setting rules to follow.

The problem is the advice ended up largely incorrect, Burr says. Change your password every 90 days? Most people make minor changes that are easy to guess, he lamented. Changing Pa55word!1 to Pa55word!2 doesn’t keep the hackers at bay.  The advice that demanded a letter, number, uppercase letter and special character – such as an exclamation point or question mark was also wrong.  Years of research has shown that these measures actually don’t do that much to foil hackers.

“Much of what I did I now regret,” said Burr, 72 years old, who is now retired.

In June, Special Publication 800-63 got a thorough rewrite, led by Paul Grassi, an NIST standards-and-technology adviser, which resulted in removal of several of these password commandments.  The new guidelines, which are already filtering through to the wider world, drop the password-expiration advice and the requirement for special characters, Grassi said. Those rules did little for security—they “actually had a negative impact on usability,” he said.

NIST’s newly updated guide instead encourages a long, easy-to-remember string of words instead.  In a widely circulated piece, cartoonist Randall Munroe calculated it would take 550 years to crack the password “correct horse battery staple,” all written as one word whereas the password Tr0ub4dor&3 (a typical example of a password using Burr’s old rules) could be cracked in three days, according to Mr. Munroe’s calculations, which have been verified by computer-security specialists.

With data accumulated over the last decade or so (which wasn’t available to Burr back then), experts have concluded that the password recommendations from 2003 don’t work because we tend to gravitate toward the same old combinations over and over.  With that in mind, Grassi thinks his former colleague Burr is being a little bit hard on himself over his 2003 advice.

“He wrote a security document that held up for 10 to 15 years,” Grassi said. “I only hope to be able to have a document hold up that long.”

So, what do you think?  Do you use 2003 recommendations to create your passwords?  Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

DOJ Asks SCOTUS to Take on Microsoft Case and Verizon Suffers its own Data Breach: eDiscovery Trends

A rare two-topic day, but both are notable…

Remember the Microsoft Ireland Warrant case, where the Second Circuit reversed earlier rulings and denied the government’s efforts to compel Microsoft to provide emails in that case?  It may not be over yet.

According to The Recorder (Government Asks SCOTUS to Overturn Microsoft Decision on Overseas Data, written by Ben Hancock), the Department of Justice last month asked the U.S. Supreme Court to overturn that landmark appeals court decision handed down last summer in favor of Microsoft Corp. that put their company data stored overseas mostly out of reach of U.S. law enforcement.  The case stems from a warrant issued in December 2013 by a U.S. magistrate judge in the Southern District of New York directing Microsoft to turn over a criminal suspect’s email data. Microsoft determined that the data was stored at its center in Dublin, and subsequently moved to quash the warrant. The district judge denied that request, but Microsoft prevailed in an appeal to the circuit court.

Here’s a link to the Petition for a Writ of Certiorari filed by the DOJ.

If the government’s petition is taken up by the high court, its decision could introduce some measure of clarity (and hopefully consistency) in the multiple legal battles playing out around the country over whether prosecutors can enforce warrants for private data stored abroad in the cloud.  For example, while Microsoft has prevailed so far in this case, Google has had two rulings go against it earlier this year in similar cases.

“It seems backward to keep arguing in court when there is positive momentum in Congress toward better law for everyone,” Brad Smith, Microsoft’s chief legal officer, said in a blog post responding to the DOJ petition. “The DOJ’s position would put businesses in impossible conflict-of-law situations and hurt the security, jobs, and personal rights of Americans.”

It will be interesting to see if SCOTUS takes the case, or we see legislation that clarifies expectations regarding data stored overseas.  Thanks to ACEDS for the tip on this story.

In other news…

As reported by ZDNet, As many as 14 million records of subscribers who called Verizon’s customer services in the past six months were found on an unprotected Amazon S3 storage server controlled by an employee of Nice Systems, an Israel-based company.  The data was downloadable by anyone with the easy-to-guess web address.

Chris Vickery, director of cyber risk research at security firm UpGuard, who found the data, privately told Verizon of the exposure shortly after it was discovered in late-June.  It took over a week before the data was eventually secured.  The customer records were contained in log files that were generated when Verizon customers in the last six months called customer service.

Each record included a customer’s name, a cell phone number, and their account PIN – which if obtained would grant anyone access to a subscriber’s account, according to a Verizon call center representative, who, according to ZDNet spoke on the condition of anonymity as they were not authorized to speak to the press.

A Verizon spokesperson told CNBC on Wednesday that, “[a]s a media outlet recently reported, an employee of one of our vendors put information into a cloud storage area and incorrectly set the storage to allow external access.  We have been able to confirm that the only access to the cloud storage area by a person other than Verizon or its vendor was a researcher who brought this issue to our attention. In other words, there has been no loss or theft of Verizon or Verizon customer information.”

Verizon said the subscribers affected was “overstated” and that the PINs that were available during the breach aren’t actually linked to customer accounts but rather were numbers used to authenticate customers at call centers.

Verizon, of course, produces its excellent Data Breach Investigations Report every year (we’ve covered it the last three years).  Will they have anything to say about their own data breach in next year’s report?  We’ll see.

So, what do you think?  Should data stored internationally, but accessed in the US, be subject to subpoena?  As always, please share any comments you might have or if you’d like to know more about a particular topic.

Also, if you’re going to be in Houston on July 20, Women in eDiscovery (WiE) Houston Chapter, in partnership with South Texas College of Law, will be hosting the inaugural eDiscovery “Legal Technology Showcase & Conference” at South Texas College of Law in downtown Houston.  I will be participating as a panelist on the “State of the Industry” panel and my colleague, Karen, will be moderating the “Legal Operations and Litigation Support” panel.  Click here for more information about the conference, including how to register!

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Anthem Agrees to Pay Over $100 Million to Settle Data Breach Lawsuit: Cybersecurity Trends

One of the most notable data breaches in recent years was the one suffered by health insurer Anthem involving the personal information of nearly 80 million individuals.  It looks like they are going to pay up big to make the class-action lawsuit that was filed in response to that massive data breach go away.

MedCity News (Anthem to pay record $115 million to settle data breach lawsuit, by Erin Dietsche), reports that the settlement must still be approved by a court, but if it is, it will stand as the biggest data breach settlement in history.

Back in 2015, the Indianapolis, Indiana-based insurer was the victim of a cyberattack that involved the Social Security numbers, birthdates, addresses and healthcare ID numbers of 78.8 million people. At that time, Anthem said in a statement, it provided two years of credit monitoring and identity protection services to all impacted individuals.

Nonetheless, more than 100 lawsuits were filed against Anthem that were eventually consolidated.

As part of the $115 million settlement, Anthem will give data breach victims at least two years of credit monitoring and provide cash compensation for individuals who already enrolled in credit monitoring. The health insurer will also cover the out-of-pocket expenses victims have incurred as a result of the data breach.

On top of that, Anthem has to allocate a certain amount of money for security purposes and make specific changes to its data security systems.

In a statement, the insurer said the settlement “does not include any finding of wrongdoing.” Anthem added that it “is not admitting any wrongdoing or that any individuals were harmed as a result of the cyberattack.”

Anthem continued: “Nevertheless, we are pleased to be putting this litigation behind us, and to be providing additional substantial benefits to individuals whose data was or may have been involved in the cyberattack and who will now be members of the settlement class.”

In a related article by the same author, it appears that Google has begun removing people’s private medical records from its Search results.  Maybe it will soon be more difficult to find (intentionally or inadvertently) someone’s medical records online.

So, what do you think?  Is this the start of a trend?  As always, please share any comments you might have or if you’d like to know more about a particular topic.

BTW, if you’re a member of a solo or small law firm or want to learn how to simplify the discovery process, feel free to check tomorrow’s webcast!

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Over 80 Percent of Hacking Related Breaches Were Related to Password Issues: Cybersecurity Trends

I’ve referred to last year’s Verizon Data Breach Investigations Report (DBIR) in several webcasts lately (including this one) and realized that this year’s report should have already come out by now.  Sure enough it has, about a month and a half ago.  Let’s see what the findings are.

Last year’s report (covered here) started with the Yogi Berra quote “It’s like déjà vu, all over again.”  This year’s report (available for download from here), despite the dire statistics below, starts with a bit more positivity with a quote from Roman philosopher Pliny the Elder: “Hope is the pillar of the world.”  Way to stay positive, Verizon!

Some interesting statistics from the 76 page PDF report:

  • 81% of hacking-related breaches used stolen passwords and/or weak passwords.
  • Three-quarters (75%) of breaches were perpetrated by outsiders, which, of course, means that one-quarter (25%) involved internal actors.
  • 51% of breaches involved organized criminal groups, while 18% were conducted by state-affiliated actors.
  • 51% of the data breaches involved malware.
  • 66% of malware was installed through malicious email attachments.
  • 73% of the breaches were financially motivated.
  • Industries affected the most: financial institutions (24%), healthcare organizations (15%), public sector entities (12%) with retail and accommodation entities combined to account for 15% of breaches.
  • Ransomware has moved from the 22nd most common variety of malware in the 2014 DBIR to the fifth most common in this year’s data.

While the report is a whopping 76 page PDF, it’s (once again) chock full of graphics and statistics which makes it easier to read than the size of the report indicates.  And, as always, Verizon has some fun with the report (see how many song titles you can find referenced within it).  The report covers everything from breach trends to an industry breakdown to a review of each type of incident classification pattern and even provides a month-by month year in review of key data breach occurrences.

You can download a copy of the report here.  Once again, you can register and download the report or just choose to download the report (which I did).  This is our third year covering the report (here is a link to the post from two years ago) and if you want to check out a comprehensive and interesting report on data breaches over the past year, this remains my favorite report.

So, what do you think?  Have you ever experienced any data breaches, either personally or professionally?  Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.