Bensinger discussed examples of major attacks and what to do if people suspect an attack has happened. He recommended that people seriously concerned about protecting private information consult with an IT specialist because, as he put it, there is no way to make your systems completely secure.

“Even if you buy the best possible security, you can still be hacked,” Bensinger said. “If you do it right, you can protect yourself much better. But you cannot expect that nobody will have unauthorized access to your systems. That’s just not a valid way to think about your business these days. It’s a matter of adding security and combining it with common sense.”

Bensinger stressed the idea of common sense. He explained that often a casual human error is the cause of breached security due to social engineering where hackers figure out clever ways to trick people.

“Social engineering is the art of manipulating people so that they give up confidential information or take inappropriate actions,” Bensinger said. “It’s an old con. It can be email, text or even in person. This is the most popular form of hacking because it is so easy and cheap that takes very little skill to implement.”

An example of this was the DNC hack where hackers were able to breach DNC’s security by sending out phony emails pretending to be someone they weren’t. It’s called phishing and it relies upon social engineering to manipulate people into bad actions.

Bensinger said that law firms can be especially threatened because they’re seen as rich targets. Often people will target firms trying to get to their clients, or are vulnerable because they’re using remote access software to login from remote locations.

“One time they had the partner’s names, they knew who they were,” Bensinger said. “I don’t know if it was a client they were specifically going after or if it was just a rich firm, but it’s not uncommon for a law firm to come to us and saying that they’ve experienced a pattern of attacks.”

He suggested that firms adopt policies and procedures in case of an attack. The National Institute of Standards and Technology has a list of recommendations for cybersecurity framework that companies can use as a guide.

In the event of a suspected attack, he suggested contacting an IT firm immediately and he said that sticking to simple and well known applications is the best practice to avoid getting hacked.

---

Related Articles

Brooklyn Bar Association will be ready for new requirements for diversity, inclusion and bias CLE

October 4 | By Rob Abruzzese, Legal Editor