| Even if lawyers don’t “technologically” sufficiently protect clients’ information, this doesn’t mean that lawyers don’t have continuing legal education responsibilities. They know the rules but don’t internalize their understanding and accordingly sometimes feel “cybersecurity is none of my field (but IT people’s)”. Given that, the following are my suggestion:
(1) Get familiar with actual leakage cases: Lawyers should be aware that they are exposed to cybersecurity risk all the time including their daily life. “Cybersecurity” sounds complicated to non-experts, but they should think about it in more familiar context. For example, they should be aware Facebook they are using outside work is spying on them for free all the time in return of providing free platform. They should look at how “their” data is being used by malicious companies in reality. Awareness of cybersecurity threats is half the battle.
(2) Practice in simulated environments: There are many courses where we can practice applying skills using real security tools in simulated environments. As I did, setting up a cybersecurity virtual lab is an efficient way (no need of experience. All needed is to prepare for running into issues, to have patience, and to keep Googling.). Perhaps, practicing ethical hacking is another way to get firsthand experience. In any case, having fun building and learning is key here, I think. Through this process, I believe they will begin to think legal cybersecurity knowledge is a fundamental part of their legal knowledge.
(3) Applying their learning to their work: They should consider what to improve in their workplace in order to protect their and clients’ information. For example, they may begin to think it should be mandatory to use end to end encryption and open source software. Then, introduce the practice. Explain and share the necessity to their colleagues and clients in their words.
(4) Keep having fun building and learning. |