As part of a strong cyber risk management plan, having defensive software in place that is consistently updated can improve security and minimize vulnerabilities that can be exploited by bad actors.
The following guidelines can help mitigate the chances of a breach through outdated software and subsequent claim against you and your firm:
Patches
Software should be patched regularly for updates. Your firm’s IT department should send out communications for all staff to update the latest patch and the reason as to why. As soon as a patch is available, it should be updated immediately. Some firms may choose to push updates to all connected devices automatically to not disrupt staff workflow and minimize the risk of staff forgetting to update.
OS Updates
Operating System, or “OS” updates, should be consistently updated, along with servers and any applications that your firm uses. For law firms, this includes law firm management software in which lawyers update their dockets that contains sensitive client and billing information. Standard OS updates for your firm’s computers such as Microsoft and Mac should also be updated as soon as one is available.
Software Testing
Your firm’s IT department should test all software updates before changes are made. Once the updates are verified, they should be distributed to the rest of the firm. Software testing is important to ensure any vulnerability has been resolved and that said update does not interfere or cause bugs (e.g. applications suddenly freezing when selecting certain tabs) in the day-to-day applications that your firm uses.
Authorized Software
A whitelist (sometimes referred to as a passlist or allowlist) of approved and authorized software should be created and as part of your firm’s cyber response plan. The purpose of using authorized software from a whitelist is that all software applications not included in said list will be automatically denied from use. This mitigates the likelihood of malware breaching your firm’s systems and protects the sensitive information your firm holds, such as financial records and sensitive client information.
Antivirus & Antimalware Installation
Antivirus & antimalware software should be provided for use on staff’s personal computers to ward off low level attacks. The terms ‘antivirus’ and ‘antimalware’ are used interchangeably, and generally its purpose is to detect, provide protection, and remove malware on computers. This can range from traditional viruses, all the way to detecting phishing emails, ransomware, spyware, among others.
Fore more information on how to best protect yourself and your firm with defensive software, contact:
Chris de Sousa Costa, MBA // 647.242.7469 // cdesousacosta@purvesredmond.com
Works Cited
Microsoft. (2022). Microsoft Digital Defense Report 2022. Retrieved from Microsoft: https://www.microsoft.com/en-us/security/business/microsoft-digital-defense-report-2022#tabxa5747e9fa3af48dcb307bf43d0905d25
