Industry Brief: Professional Services Cyber Risk Priorities

Why the risk profile differs

A law, accounting, consulting or advisory firm holds information about deals, disputes, tax positions and strategy for many clients at once, sometimes for competing ones. To an attacker, a client’s pending transaction or litigation can be worth more than anything in the firm’s own systems. One firm can offer that for many clients through one set of credentials.

Three features of the sector shape the risk. Work is organized around matters or engagements, so data is copied into workspaces, shared portals and personal working files. People are mobile and often partly external: contractors, secondees, temporary staff, clients with guest access. And authority is personal. A senior person’s request carries weight, and exceptions to policy are normal.

The priority order

1. Identity and privileged access

Two incidents from outside the sector show the mechanism. In the Snowflake customer-account campaign, Mandiant found that attackers signed in with valid credentials taken by infostealer malware from other systems, against accounts that had no multi-factor authentication. Some of the infections began on contractor laptops that were also used for personal activity, and Mandiant noted that such devices could give an attacker access to several client organizations. A consultant who serves many clients from one laptop is the professional-services version of that sentence.

In the incident Microsoft attributed to the actor it tracks as Midnight Blizzard, the attacker password-sprayed accounts and found a legacy, non-production test account with no multi-factor authentication. From there it reached a legacy test application with elevated access. Every firm has equivalents: old matter mailboxes, service accounts left over from past projects, shared logins for a client portal. They are often exempt from the policies the rest of the firm follows. The exemption is the exposure.

The decisions are concrete. Apply phishing-resistant multi-factor authentication and conditional access first to partners, executives, administrators and finance staff. Inventory the accounts that bypass multi-factor authentication and retire them. Review guest access to firm workspaces on a schedule, with an expiry date for every guest.

2. Client-data custody and segregation

When a firm has an incident, the first question from clients is whether their information was involved. A firm that cannot answer within hours loses time and trust together. Answering requires knowing, client by client, which systems hold their data: shared drives, matter workspaces, e-discovery platforms, backups, and copies held by providers.

Professional duties raise the stakes. In the United States, ABA Formal Opinion 483 addresses lawyers’ obligations after an electronic data breach or cyberattack, including notifying current clients when their material confidential information has been compromised. Other jurisdictions and professions carry their own duties, and they differ. Confirm with counsel which apply to each practice.

Confidentiality walls between clients or teams are usually policy. Where the matter warrants it, make them technical: separate workspaces, access reviews tied to matter staffing, and alerts on access from outside the matter team.

3. Payment and impersonation fraud

The FBI’s Internet Crime Complaint Center reports about $3.05 billion in business email compromise losses across 24,768 complaints in its latest annual report, all victims and sectors combined. This brief draws no sector figure from them. The structural point stands without one. Business email compromise works against organizations that move money, or relay payment instructions on behalf of others, because a convincing instruction from a known person is routine business. Firms that hold client funds or tell clients where to send payment fit that description.

Verify payment-instruction changes through a second channel, using contact details held independently of the request. Set approval thresholds that include senior-person requests, which are the ones most likely to be rushed. Agree with clients how bank details will and will not be communicated, so a client can recognize a fake.

4. Contractors and third parties

E-discovery, transcription, translation, document management, IT support and overflow staff all hold copies of client data. Tier providers by the data they hold, not by contract value. For each tier, test what matters: where the data is stored, who at the provider can retrieve it, whether devices are managed, and how data is returned or deleted at the end of the engagement.

For contractors who work from their own devices, the realistic choices are a managed device, a controlled virtual workspace, or no access to sensitive matters. A completed questionnaire is not a fourth option.

5. Client security requirements

Large clients ask firms to complete security questionnaires, accept outside-counsel or vendor guidelines and sometimes submit to audit. The usual response is to answer each request separately. That produces inconsistent answers and no single picture of what the firm does.

A better approach is one control baseline, mapped to what clients ask, with evidence collected once and reused. Certification to a recognized standard such as ISO/IEC 27001 can support that, but only if its scope covers the systems that hold client matter data. A certificate scoped to the head-office network does not.

What to rank lower

• Broad phishing-awareness programs ahead of privileged-account controls.

• Encryption projects that leave administrator accounts weakly protected.

• Annual testing of the public website while the collaboration tenant, guest access and legacy accounts go unreviewed.

Resilience: deadlines change what availability means

Availability in a professional-services firm is measured in deadlines: court filings, audit sign-offs, deal closings, regulatory submissions. A day of lost access can mean a missed one. Identify the work that carries hard external deadlines, rank systems by the deadlines that depend on them, and agree manual fallbacks for each.

Decide in advance who speaks to clients, in what order, and what the firm will say it knows and does not know. The communication plan is part of recovery, because clients are deciding during those hours whether to trust the firm with the next matter.

Questions for the next leadership review

1. Which accounts can reach the most client data, and are they held to our strictest authentication?

2. For any client, can we list the systems that hold their data, including copies held by providers?

3. Which legacy, shared or exempt accounts remain active?

4. How would we confirm a changed bank detail, and who approves a senior person’s request?

5. Do we answer client security requests from one baseline, or one at a time?

Sources

1. Google Cloud Threat Intelligence (Mandiant). UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion.

2. Microsoft. Midnight Blizzard: Guidance for responders on nation-state attack. Microsoft Security Blog; initial access through a legacy test account without multi-factor authentication.

3. FBI Internet Crime Complaint Center (IC3). Internet Crime Report (annual). Business email compromise complaints and reported losses.

4. Blank Rome LLP. ABA Issues Formal Opinion Detailing Lawyer Obligations Relating to Cyber Attack Incidents. Secondary summary of ABA Formal Opinion 483, Lawyers’ Obligations After an Electronic Data Breach or Cyberattack.