Effective Security Starts at the Top: The S.C. Supreme Court Mandates Strong Passwords

Earlier this month the South Carolina Supreme Court ordered all members of the South Carolina Bar and all foreign legal consultants to log-in to the Attorney Information System (AIS) and 1) adopt a stronger password; 2) choose and answer updated security questions; and 3) update and verify their contact information in AIS.  Pursuant to the terms of the Order, those who fail to do so by December 15, 2013 may face suspension.

The Court's Order offers good lessons for all attorneys (and others) attempting to secure their firms and businesses.

Security is a Process, Not A Product

The Court recognizes that the security of the AIS relies in no small part on strong passwords created by attorneys, and mandates a process to attain that end.  As discussed here, human mistakes (as opposed to software or hardware inadequacies) account for most security breaches.  Using a  "weak" password (one that a computer can guess by means of generating many characters) or a "common" password (one that a person can guess or read) is like leaving a door open or a safe unlocked.

Although various technology products offer essential parts of an effective security program, (as discussed here and in  Locked Down: Information Security for Lawyers) no product will save you from yourself if you decide to use "password" as your password, use the same password on multiple sites, click on bad links, or voluntarily share your bank account number in response to an email message.

Consider how to make security a priority in your firm, through the use of policies, training, and/or other methods.  And understand that the combination of people, processes, and technology is necessary for appropriate security.  

Any Effective Security Process Has Support From The Top and Appropriate Teeth

A Supreme Court mandate with Chief Justice Toal's signature and the threat of losing the ability to practice law is an effective way to get an attorney's attention and ensure compliance.  Moreover, the fact that attorneys will not be allowed to pay their license fees until they have complied with the Order all but ensures 100% participation.

By contrast, how many attorneys would have updated their information in response to an email memo from a systems administrator for the AIS suggesting the use of stronger passwords?  How many of you consider the recommendations of your IT staff, implement same, and follow through to make sure they are followed?

Protecting the client file as required by Rule 1.6 (“Confidentiality of Information”) and Rule 1.15 (“Safekeeping Property”) of the South Carolina Rules of Professional Conduct ("RPC") includes securing electronic information.  A security breach caused by a weak password or indiscriminate browsing may cause the same unauthorized disclosure of a client's confidential information as the theft of a paper file.

Conclusion  

Although strong passwords may be a hassle and create yet another thing for attorneys to remember (and for some assistance with "password fatigue" click here), clearly their use is one part of an effective information security program.  Just as incentives and discipline are used in connection with other corporate purposes and obligations (e.g. to "encourage" lawyers to get their time in), so too should lawyers consider how to best encourage and enforce the development of a culture of security in their firms.     

Remember (and Protect) the Important Stuff: Part Two- Eliminate Password Fatigue With LastPass

In a recent post, I discussed the dilemma facing anyone who does any significant amount of personal and professional business online:  safe and secure transactions require the use of strong, unique passwords, but keeping up with that much information can be difficult from a time and energy perspective.

My solution to this conundrum (it may be more of a conundrum than an actual dilemma) is to use a free product called LastPass.  After you have set up an account and chosen a password (yes, this is one password you have to remember), each time you visit a site and enter your login credentials, LastPass will remember that information, store it securely, and then automatically fill it in.  Another plus is that it works on all of your desktops, laptops, tablets, handhelds, and whatever the next cool thing you determine is necessary to own.

Also, LastPass will actually generate strong passwords for you, which is especially helpful if you have a history of using passwords like "123456" and the clever "password."

Some aspects of LastPass that sound nifty but that I have not used yet include its automatic form filling feature, and its vault allowing storage of all kinds of personal and business data (like for instance the PIN I forgot at the gas pump).

The best way to understand how LastPass works is to watch one of their very short videos.  I recommend either this one (What is LastPass?) or this one (Why Use LastPass?).

Remember (and Protect) the Important Stuff: Part One- On the Horns of the Password Dilemma

The Setup

Last weekend I had two of my children in the car and we were headed somewhere (I have forgotten where, which is one of the points of this post, so read on).  I stopped at the corner store (it might be a BP, it could be a Circle K-- it doesn't matter -- again read on) because I was dangerously low on fuel. (One reason I had run it down below empty is because I spend so much time keeping thousands of things in my head that crowd out the need to be mindful of important information like fuel levels).

When I went to turn the pump on, I could not remember my debit card PIN (not "PIN number").  While this lapse was not catastrophic, because I could choose the "credit" function, I wondered what I could do to make sure this did not happen again.  (And lest you point out that I could store my PIN in my smartphone, you are absolutely correct but that is not the point I am making here).

The Challenge

I (and you) have a limited amount of time and energy to expend in a day.  And as I have discovered as an adult (when these things have mattered), I simply cannot remember (or do) everything, but have to pick and choose wisely.  As Scott Hanselman put it:  Productivity is not about about doing everything; it is about doing the right things and ignoring the rest.  And when I cannot remember something important (like a PIN), I choose to believe that is the result of unimportant things crowding out that fact.

So what "unimportant things" do I choose to remember?  Well, in addition to regrettably unforgettable commercial jingles from the 1970s, the entirety of School House Rock, and movie lines from my youth, one likely group of suspects is the myriad usernames, passwords, PINs, etc. I use online.  I am pretty sure that these online presences are the "right things," because I can't conceive of physical banking and shopping anymore.  And it doesn't appear that the Internet is going away.  But the exercise of recalling how to access these services, as well as the attendant time and frustration involved in retrieving and resetting user credentials when I cannot recall them, are both unproductive and inefficient.

In short, I need my day (my time) and my brain (my energy) for the important stuff.  It wouldn't be a post on this blog without yet another tip of the cap to The Checklist Manifesto: How to Get Things Done Right, and Gawande's point that making sure all of the little stuff is taken care of frees us up to do the heavy lifting.  Put another way, as I have written here as well, I only have a finite amount of brain energy to expend in a given day, and I can scarcely afford to burn it trying to remember a password. 

The Dilemma 

 
Of course, one option is to use one password for all your sites.  Less to remember, so fast and easy, what's not to like?  I would be willing to wager that most computer users (i.e you the reader) do just that because it is so easy and convenient.  However, using the same password for more than one site can have disastrous consequences in the event just one site you use is hacked.  Put it this way:  you wouldn't even consider using one "master" key for your all your physical locks (office, home, etc.), even though that would certainly be easier.  And  you don't because if the one place with the weakest security is compromised (e.g. a former employee fails to return an office key) the whole system can be compromised.  That is exactly what you are doing if you have one password.  And you are in even bigger trouble if your password is so simple it could be compromised by a brute force attack, or if it can be easily guessed (like . . . wait for it . . . "password").  If you need further convincing,  please read James Fallows' "Hacked" in the The Atlantic to make this point sink in.

On the other hand, although the process of creating, changing, and keeping track of strong, unique passwords is essential, doing so taps time and energy.  Establishing and routinely modifying a unique case-sensitive,12-character password with letters, numbers and characters for multiple sites is the stuff of cryptographers and mathematicians. And recall the the way you felt the last time you couldn't remember your password, (or your username, reminder, or challenge question), and the frustration you experienced in stopping your transaction or interaction and going through the process of retrieving and resetting.  Heaven forbid you actually have to get on the phone with someone to get logged in. 

So until a better password system comes along,  wouldn't it be nice if you could conserve your time and energy by keeping only one password in your head (leaving more room for other important stuff), while at the same time browsing and transacting safely and securely?

In the next post, I will discuss one such solution.