How to Avoid Disaster: What Every Lawyer Should Know About Backups, Security, Viruses, Spyware and Disaster Planning

Transcription

1 How to Avoid Disaster: What Every Lawyer Should Know About Backups, Security, Viruses, Spyware and Disaster Planning By Jim Calloway Publisher: Jim Calloway s Law Practice Tips at Digital Disaster stories are becoming more and more common. It seems like everyone has heard a story of a recent hard drive crash or a power surge that ruined some equipment. Generally speaking, there are two broad approaches to avoid the impact of a digital disaster on your business. Both of these approaches must be followed religiously to protect the law firm data. The first of those areas is to have appropriate and adequate data backup and storage procedures. The second of these areas is to employ technology tools and office policies that protect your office network from unnecessary risks

2 Let s discuss backup first. Backup is extremely important and the number of firms that fail to do backup adequately is still shocking. Let s look at a few statistics. Company Bankruptcy - 93% of companies that lost their data for 10 days or more due to a disaster filed for bankruptcy within one year of the disaster. (National Archives & Records Administration in Washington) Tape backup Failure - 34% of companies fail to test their tape backups, and of those that do, 77% have found tape back-up failures. (The Gartner Group) Theft - A laptop is stolen every 53 seconds (FBI) Some might be surprised at the different causes for losses of data. Here s a breakdown. Hopefully, the case for backing up is irrefutable. So the question is what method to use. Backup tapes are an outdated technology. While large firms with dedicated IT departments may still appropriately use tape backup processes, solo or small firms lawyer who are doing their own backup should no longer be using tapes. Backup tapes are unreliable, more expensive, increasingly harder to find and are more difficult to restore than backups created using a portable hard drive. The image at the right is a Western Digital - My Passport Essential SE 1TB External USB 2.0 Portable Hard Drive. For those who are not familiar with the term TB, it stands for terabyte. A terabyte equals 1024 Gigabytes. This drive plugs into a computer s USB port. It comes with pre-installed software to first backup an entire hard drive

3 and then regularly backup any new or changed files on a schedule that you specify. It also provides password protection and encryption. The cost for this device with its huge amount of storage, coupled with all the software you need preinstalled is $ at the local Best Buy when I last checked. There are less expensive models with the same preinstalled software and less storage capacity. There are a few other considerations for valuable law office data. But if you haven t been backing up all of those family photos and itunes music purchases on the home computer, maybe you need to stop at a Best Buy on the way home and protect the important family digital data now. For the law office computer network, a more complete data backup is required. (Although if you haven t done a backup in weeks, do this on the way home and you ll be in better shape in the morning than you are now backup wise.) Surely every lawyer can appreciate the consequences of the loss of all the word processing forms and all of the billing records without even going into , contacts, calendar entries and other important information on the office network. The careful lawyer will have at least two, and more likely three or more, separate data backup processes. Storing a fairly current backup outside of the office is critical in case the office is hit by fire or flood. (Speaking of flooding, it is important that computers and servers are not stored on the floor in case of minor flooding or water from firefighters. A five or six inch high stand for every computer may save you tons of aggravation some day in the future.) Offsite backup can be accomplished in many ways. One could buy several of the portable hard drives and rotate them outside of the office. (Although data security experts recommend that remote data storage is at least 100 miles from the office.) Other law firms will utilize automated remote backup services. Some will make use of manual uploads to document repositories. Once you have a good backup plan in operation, you need to conduct test restores. A backup is only good if you know how to restore the backed-up data. Every lawyer, no matter how technically ignorant otherwise, must know how to restore from the backup. It may be their brief that needs to be covered today and no one may be available to help them. One should not discount the idea of spot backups as well. One might copy forms or an Outlook PST file to a thumb drive, just to have another copy. If one has been

4 working on a brief for several hours, ing a copy to your Gmail account or copying it to a thumb drive is a good backup plan. Cloud computing practice management solutions are a relatively new concept that include backup as a part of the service but create other data security concerns for many lawyers. To paraphrase the old cliché, one can never have too much money, be too thin or have too many backups. It should also be noted that the more a law firm has gone paperless with digital client files, the more a backup will have the effect of restoring the entire law practice in the event of physical office destruction. See my article The Paperless Office as a Risk Management Enterprise at Disaster Plans In addition to a backup plan, a written general disaster recovery plan is required. Each law firm, whether a solo lawyer or a larger firm, needs to create a backup plan and put it both in writing and into practice. It must be protection prioritized. This means protect the people first then protect the business assets. Recovery tends to work in the same order. First, a mechanism for locating and contacting people (employees, clients, courts) and then mechanisms for protecting the business s assets and ability to continue to operate and meet its legal and financial obligations. What is the Essential Core of Your Practice that absolutely, positively must remain operational? Review the potential disasters and what your responses would be to each. Draft Your Plan write it not only in plain English but also to be understandable by panicked, stressed out people who have just experienced a disaster! Diversify your Options in other words, have backup plans for your backup plans (anticipate Murphy s Law and don t put all your disaster recovery eggs in one basket!) Plan for Failure not unlike advising a client to always plan for litigation build redundancy into your technology systems fully expecting digital disasters to hit Fire Drills you have to take your plan seriously and conduct straight-faced tests on a regular basis

5 The American Bar Association provides disaster recovery information and links at and Internet Security Passwords Strong passwords are a critical security concept. Many lawyers use passwords and password recovery options that are not adequate. More of you should consider strong password managers, like Roboform ( or LastPass ( with an installation of the product on a secure flash drive. Sarah Palin s Yahoo account was hacked by someone doing some online research and figuring out her Yahoo password recovery question and answer might be where did you meet your true love? with the answer being the name of her high school. So how long do you think it would take someone to search online obituaries and figure out your mother s maiden name? It is strongly suggested that you make up a fictitious mother s maiden name like BX345!! and use it for your security question answer to that question. If you use weak passwords than nothing is secure. But most of us cannot remember passwords if they are strong enough to be secure. A password cannot be any word that might appear in a dictionary. Restore Points Another important security issue is learning how to set Restore Points and use them effectively. This is a powerful tool that many users simply ignore. No matter how secure your defenses, it is likely that your computer will get fouled up at some time whether from spyware or other malware or just the installation of a new application that conflicts with something on your computer. It is a real time-saver just to be able to set the computer back to the settings from yesterday or a few hours ago. Microsoft provides tutorials for restore points. Here are some links to some sources of information. Windows XP System Restore Guide

6 Windows Vista System Restore Guide How to Create a Restore Point in Windows Firewalls, Anti-Spyware and Antivirus A firewall is your guard to keep the bad things outside of your computer network. The Microsoft firewall actually works quite well. In fact Microsoft s entire suite of security tools work quite well and they are free. It is understandable that many will still wish to rely on third party tools given the history of their superiority and the fact that malware designers would try to build tools that would defeat the widely-used Microsoft tools if possible. Microsoft Security Essentials is a free antivirus and spyware package. Microsoft also has a malware removal tool When I want to purchase a new utility, such as anti-malware tools, I go to the reviews on C Net, PCMag.com and PCWorld.com to see what the current state of effectiveness is at the moment. I d never purchase a Norton anti-malware utility of any kind based on past experiences, but that s just me. This following link is to a chart of malware testing results by the people at Virus Bulletin. They tested software for current malware (reactive) and future malware (proactive) detection. The higher the malware application is on the chart (vertical axis) and the farther to the right (horizontal axis) reflects its effectiveness. This was based on testing in April 2010 and should be valuable for at least the rest of the year. If you ever encounter a computer with really bad malware infection, it may be really hard to repair. Often these are caused by people clicking on what they think are ads for anti-malware and actually approving the installation of malware on their machine under the guise of it being antimalware protection. These insidious infections will actually block one from visiting antimalware sites and downloading help. You can

7 manually delete the infected files, but parts hide in your registry and other places and it keeps coming back. Here s the most effective method I have found short of giving up and reformatting the hard drive: 1) Disconnect the infected computer from the Internet and any network. If it is laptop, disable wireless networking. 2) Go to another computer and download the free version of MalwareBytes Antimalware from to a flash drive. Do not install it. Load the.exe file to the flash drive. 3) Put the flash drive into the infected computer and copy the.exe file to the infected computer. Remove the flash drive immediately. (No sense taking chances on infecting it, even though that is not likely.) 4) Run the file on the infected PC to install MalwareBytes Anti-malware on the infected computer. Turn off all power save, screen saver and go to sleep settings on the infected computer as this may take hours. Run it and see what happens. 5) Consider buying the premium package out of gratitude if it works. (And one day soon you may have to buy the premium package to so this anyway.) Malware Prevention Every six months one should remind office staff and lawyers that they should never, never click on attachments to or links in s unless they are sure of the source. It is OK to telephone someone to ask did you really send me that? Although there are such things as Microsoft Word Macro viruses, it is generally safe to open documents. Files ending with.exe or.htm or.php are particularly suspect and generally not the types of files that a law office would be ed. Whatever firewall or anti-malware solution you employ, make certain it is set for automatic updates and that you pay for your annual fee as soon as you are aware it is due

8 iphones: Too Insecure for Lawyers? My good friends and colleagues, Sharon D. Nelson and John Simek, have taken the lead in criticizing the iphone s lack of security. (Sharon is my teammate on our monthly Digital Edge: Lawyers and Technology podcast.) Their article Why Lawyers Shouldn t Use The iphone: A Security Nightmare bears reading by every lawyer who is contemplating an iphone purchase. You should read that piece in its entirely to appreciate my security tips below. However, I must note that I have read the article several times and I m not giving up my iphone. But I do appreciate that Apple has a poor design in that the passcode is too easy for a pro to bypass. Hopefully if I lose my iphone it won t be found by a pro. IPhone Security Tips 1) Don t lose your iphone. All of security questions about the iphone revolve around what can be done if someone with expertise comes into possession of your iphone. 2) Use a passcode to lock the phone. Yes, it makes the phone a little less easy to use, but it is the equivalent of locking your doors on your office. 3) Set the iphone to automatically wipe its data after ten consecutive incorrect passcode attempts. 4) Consider other remote wiping and lost phone locator options. MobileMe may sound like a good investment to many. It is a $99 per year service from Apple that allows you to track the location of an lost or stolen iphone and to remote wipe all of its data if it is connected online. 5) As soon as possible after losing an iphone, change your passwords on your e- mail, contacts and social networking accounts. 6) Regularly sync the iphone to itunes to back up your apps and data. 7) Consider what data may be carried on your iphone. Some may opt not to have the office on the phone. Others may do periodic wipes of the phone and then restore the settings and apps (but not the data) via itunes. 8) Put your business card in the iphone protective case with Reward offered for return of lost iphone written on the back to help encourage someone to do the right thing

9 9) Don t lose your iphone. Metadata Disclosure Solutions By now, hopefully most all practicing lawyers are aware of the possible dangers of inadvertently disclosing client confidences or other embarrassing material via hidden metadata. A full discussion of metadata is outside of the scope of this discussion, but one can read my blog post, The Mysteries (and Magic) of Metadata at There are many possible solutions to the issue of disclosing metadata. Some combination of the following may work best for your office. Purchasing a metadata scrubber and using it is the best solution. Fax or snail mail rather than . Copy all text (Cntrl +A, Then Cntrl + C) and Paste it into a blank document. Note: This will carry some metadata, but not Track Changes or Deleted Comments. Copy all text (Cntrl +A, Then Cntrl + C) and Paste Special- Unformatted Text into a blank document. Note: You lose the metadata, but the document formatting as well. Every time you send an attachment that you have created or edited, send it out in PDF format (with rare exceptions) My Personal Best Practice Solution Note: PDF files will contain some metadata, but that limited kind is unlikely to cause trouble. This is not practical when you are co-authoring a document with another. With co-counsel, you just need to discuss the issue. With opposing counsel, you may need to use a metadata scrubber. Microsoft Word 2002 Review white paper at but consider upgrading or buying a metadata scrubber. Microsoft Word 2003 (and other MS Office products) Download and install the Remove Hidden Data Tool for Office 2003 and Office XP Microsoft Word 2007 The Remove hidden data tool is built in. No separate download required. (Note: Computer forensics experts tell us the results from the free Microsoft tools listed above are imperfect.) Corel WordPerfect Upgrade to Versions X3 or X4 which have the publish without metadata feature. WP versions 9 and higher have the publish to PDF

10 option built it as well. (WP has less potentially dangerous metadata than Microsoft Word in the first place.) Purchase a third party metadata scrubber and use it. There are many such products, but we direct your attention to the Metadata Assistant from (Direct link to retail version - An Enterprise version for more than 20 workstations available as well.) At a purchase price of $79 per license, this is a tool that most law firm should consider. This will also allow you to view the metadata in other files, not that I can assure you that practice is always ethically permissible