Legal IT audit reveals significant flaws in law firm security

5 Feb 2024News

A simple omission by legal IT Staff has led to over half of SRA registered law firms in the UK vulnerable to scams

Self Studio London's cybersecurity audit exposes a concerning 56% vulnerability among SRA registered law firms, lacking DMARC protection against email spoofing. In a cybersecurity audit, Self Studio London has uncovered a significant vulnerability within SRA (Solicitors Regulation Authority) registered law firms in the UK. The study, conducted in early 2024, reveals a startling statistic: 56% of these firms are susceptible to 'email spoofing,' a deceptive tactic allowing attackers to impersonate legitimate email senders.

The comprehensive analysis targeted 3,964 law firms listed on the SRA register with operational websites. The results are alarming, with 2,225 of these firms lacking DMARC (Domain-based Message Authentication, Reporting, and Conformance) records – a critical defence mechanism against email spoofing. DMARC records play a pivotal role in verifying the authenticity of emails sent from a domain, preventing attackers from forging email identities.

Email spoofing poses severe security risks, enabling attackers to manipulate the sender's address in an email, often masquerading as a trusted source. This tactic can lead to phishing attacks, where recipients are deceived into divulging sensitive information, or the distribution of malware through seemingly legitimate emails.

The gravity of Self Studio London's findings is amplified by the nature of information handled by law firms, emphasizing the urgent need for robust cybersecurity practices. The absence of DMARC records exposes law firms to successful email spoofing attacks, jeopardizing not only their security but also the confidentiality of their clients, who are frequently involved in sensitive legal matters.

This vulnerability underscores a critical oversight in the cybersecurity practices of UK law firms, prompting a call to action for the legal industry. Self Studio's audit serves as a stark reminder for firms to prioritize email security and implement essential measures, such as DMARC, to mitigate the risks associated with email-based threats.

Self Studio London strongly recommends that all law firms conduct a thorough review of their email security protocols and swiftly adopt DMARC records. This proactive approach will not only shield firms and their clients from potential fraud and data breaches but will also enhance the overall trust and reliability of communications within the legal sector.

If you have any doubts about your setup, contact Self Sudio

Photoby Robert Kloosterhuis - https://www.flickr.com/photos/jemimus/66531212/ (original size version), CC BY-SA 2.0, https://commons.wikimedia.org/w/index.php?curid=818348

Legal News desk contact: editorial@solicitorsjournal.com|

If you have any doubts about your setup, contact Self Sudio

Photoby Robert Kloosterhuis - https://www.flickr.com/photos/jemimus/66531212/ (original size version), CC BY-SA 2.0, https://commons.wikimedia.org/w/index.php?curid=818348

UK to raise social media age limit

The UK plans to increase the minimum age for social media access to 16, following Australia's lead addressing online safety for children

SPP urges HMRC to reconsider pension tax

The Society of Pension Professionals has called on HMRC to address concerns over inheritance tax on pensions to avoid confusion for families affected by bereavement

Progress in cleaning up Companies House

A new report highlights ongoing improvements to the Companies House register aimed at tackling economic crime

Re Poundstretcher: cross-class cramdown survives even when six landlord classes say no

The Chancery Division sanctions Poundstretcher's restructuring plan despite six dissenting landlord classes, applying the Adler and Petrofac framework.

Ponsford v Sali: a property partnership's messy divorce shows why documentation wins partnership disputes

The Chancery Division takes a pragmatic, evidence based approach to untangling a property partnership built on undocumented cash dealings.

North Somerset District Council v Secretary of State: failing the flood sequential test is not the end of the story

The Planning Court confirms that a failed flood risk sequential test still gets weighed in the planning balance, not treated as an automatic refusal.

Thomas Armstrong (Aggregates) v Housing Secretary: when landfill buries a quarry's right to be reviewed

The Planning Court applies Pilkington and Hillside to find a 1954 quarry permission can no longer be revived under the ROMP regime.

Clerkenwell Lifestyle v HG Construction: be careful what you call "agreed" in extension of time correspondence

The TCC enforces a £955,943 adjudication award after rejecting a contractor's late attempt to recast email exchanges as a binding settlement.

Ward v Donnellan: when both sides lie, "no order for costs" is not a free pass

The Court of Appeal overturns a no order for costs ruling, finding a judge let a dishonest claimant off too lightly.

London Borough of Camden v BW: when a single missing fact can decide a capacity case

The Court of Protection finds an expert's failure to explore one consequence, losing a placement, was enough to undermine his capacity assessment.

Griffiths v Essex County Council: EAT clarifies causation in discrimination remedy awards and sends pension loss back for recalculation

A single act of indirect disability discrimination can ground a full loss of earnings award, even where a later constructive dismissal claim was framed only...