LSB June 2022 LR

More documents

Recommendations

Info

CLOUD COMPUTING An Analysis of the Law Society of South Australia’s Cloud Computing Guidelines: Data Security MARK FERRARETTO, SOLICITOR, EZRA LEGAL This is the third of five articles that analyse the Law Society’s Cloud Computing Guidelines against candidate cloud systems and on-premises systems. My thesis is that the caution expressed in the Guidelines should be applied as much to on-premises systems as cloud systems to obtain the best risk profile for a practice’s information systems. In this article we discuss data security. Data Security This is where cloud services really shine. Ironically this is also the area which is usually of the greatest concern. The question to ask is whether a practitioner would prefer to delegate the security of their data to a provider with extensive resources dedicated to the maintenance of data security and the detection and resolution of security incidents, or to manage data security themselves, either directly or via an IT provider, neither of whom is likely to be a cybersecurity specialist. The resources and skills required to detect and protect against security intrusions is way beyond the capabilities of most IT providers. Cybersecurity has evolved to its own discipline and there exist businesses that specialise in cybersecurity management, most of whom are not engaged by legal practitioners to manage their IT infrastructure. Detecting an intrusion is itself very difficult. If an intrusion remains undetected, as many are, an intruder could usually remain, or ‘dwell’, in a compromised system for many many months. 1 Cloud services encrypt data at rest (when it is stored) and in transit (when it is sent to a computer to use). Cloud providers usually have robust systems in place to ensure the keys used to decrypt data are not easily accessible. Table 3 Data Security ENCRYPTION AT REST Dropbox Yes Yes Dropbox Business Yes Yes Google Workspace Yes ENCRYPTION IN TRANSIT Yes Apart from Actionstep, all the service providers analysed for this paper encrypt data at rest and in transit. Actionstep does not encrypt data at rest by default but it can be requested. It is true that cloud services provide an easier target for intruders. However, this is offset by the increased security resources dedicated to detecting and mitigating this risk. On-premises data is almost always not encrypted, particularly on practice management servers and file servers. On-premises backups are also usually not encrypted and may not be stored in a secure location. An intrusion into an on-premises system carries significant risk of going undetected, and the intruder is likely to have access to unencrypted client information for an extended period of time. EFFECT OF TERMINATION Will notify and give opportunity to export data Provision to export data after termination Access to data ceases on termination CHANGE OF CONTROL Will notify and ‘outline your choices’ Not specified Will give notice Microsoft 365 Yes Yes Not specified Not specified LEAP Yes Yes Actionstep Optional, on request Yes Data retained but inaccessible Delete data 30 days after termination On Premises No No N/A N/A Not specified Not specified Verdict In my view, cloud services do data security much better than on-premises services. Although cloud might be an easier target, this risk is in my opinion more than offset by the much higher level of cybersecurity skills present inside cloud firms (or at least the candidate firms discussed) than what exists in the onpremises context. Data security is a comprehensive win for cloud in my view. In the next article we discuss data resilience. B Endnotes 1 See eg: ‘Asia-Pacific Lags in Dwell Time, Study Reveals’, Security Intelligence . 24 THE BULLETIN June 2022
PROMO Integrating Document Management: A Multi-faceted Growth Strategy To attract the most impressive talent, legal firms – among others – are pushed to come up with innovative solutions, such as offering employees the level of flexibility they became used to during the pandemic. Day-to-day, that means the staff at legal firms are increasingly spending at least part of the week working from home or outside the office, and this brings about challenges of its own. Digitising your workplace for a mobile workforce is not so much an option but a requirement. With so much paper to control in your business, both in the business and from clients, it is difficult to make sure your whole office is with you when you are working from home. The good news is that it’s available. Digitisation solutions from Canon that integrate with your line of business systems such as (LEAP, LexisNexis, Affinity, FilePro, Practice Evolve, Alite and Aderant) can improve productivity and accessibility for your staff. Keep your documents secure and accessible with Canon’s secured digitisation solutions to store the records in the right matters. Legal firms that take advantage of these systems work in an integrated digital environment where teams are empowered to boost productivity – whether they’re working from the front office, the back office, home office or even court. By integrating hardware with stateof-the-art like the uniFLOW software, these firms are equipping their teams with instant access to up-to-date documents when they need them. Furthermore, they enable teams to update documents as matters evolve with accuracy so clients can be kept in-the-loop in real-time. At times like these, when every dollar counts – both to the firm and your clients – firms that invest in digitisation solutions are also lowering costs by reducing the need for administrative staff to be involved in long paper-based processes. Importantly, they benefit from automated audit trails that enable jobs to be automatically assigned and precisely charged to cost centres. For more information on how Canon can help your firm, contact Gary Bennetts | gary.bennetts@sales. canon.com.au Canon Authorised Agent SCAN QR CODE TO LEARN MORE or visit to https://www.canon.com.au/ business/legal-solutions B We Are Forensic Experts In • Engineering Analysis & Reconstruction • Traffic Crashes & Road Safety • Workplace or Mining Incidents • Reporting & Experts Court Testimony Delta V Experts • Clarifies the facts in a situation • Scientifically substantiates the evidence • Failure Analysis & Safety Solutions • Physical, Crash, Incident & Vehicle Dynamic Handling Testing DELTA-V EXPERTS • Strengthens your communication • Diverse experience and expertise 03 9481 2200 www.dvexperts.net 9 Springbank Street, Tullamarine, 3043 June 2022 THE BULLETIN 25
Page 1 and 2: THE BULLETIN THE LAW SOCIETY OF SA
Page 3 and 4: This issue of The Law Society of So
Page 5 and 6: PRESIDENT’S MESSAGE Society busy
Page 7 and 8: FEATURE • What level of Covid-19
Page 9 and 10: PUBLIC HEALTH LAW direction made un
Page 11 and 12: TRAVEL (such as on public transport
Page 14 and 15: FEATURE TRAVELLING WITH PETS: WHAT
Page 16 and 17: FEATURE Imports from rabies-affecte
Page 18 and 19: FEATURE SPACE TRAFFIC MANAGEMENT: E
Page 20 and 21: MENTAL HEALTH LAWS Increasing the P
Page 22 and 23: MENTAL HEALTH LAWS capacity test ac
Page 26 and 27: RISK WATCH Waive goodbye? A new cas
Page 28 and 29: FAMILY LAW CASE NOTES Family Law Ca
Page 30 and 31: YOUNG LAWYERS facebook.com/YLCSA Ju
Page 32 and 33: BOOKSHELF D Brennan The Federation
Page 34 and 35: TAX FILES attention. Examples of a
Page 36: We manage one of SA’s largest soc

LSB June 2022 LR

Create successful ePaper yourself

Delete template?

Save as template?