Cloud myth #3: You can build modern security on legacy technology

As large and midsize law firms contemplate a move to the cloud, questions and concerns around security often arise. After all, law firms must ensure they take steps to secure and protect their data and financial records — and those of their clients. Traditional security measures still commonly employed with on-premises systems — emphasizing authentication and limiting access based on location and IP address — don't afford the same protections in a cloud environment.

In this third installment of our cloud myth series, we discuss misconceptions some law firms have about being able to simply bolt on modern security attributes to existing legacy security technology within a cloud environment. We'll explore how the security vulnerabilities of a traditional "trust but verify" model become glaringly apparent when applied to a cloud environment where it's paramount always to assume a breach and apply zero-trust principles.

What is zero-trust security?

Zero trust is a security model that helps organizations reduce the risk of data breaches and cyberattacks based on the principle of "never trust; always verify." Whereas traditional trust-but-verify security models allow widespread access once a user is on a network, zero-trust architecture seeks to limit access via a modular or layered approach. Access controls are based on several factors, including the user's identity, device security posture, location, and behavior. The rules are enforced at every access point.

For law firms, the importance of zero-trust security principles within a cloud environment came into sharp focus during the pandemic as firms were forced to find ways to operate in a work-from-home environment overnight securely. During this time, the networks of law firms that relied on traditional VPNs for attorneys and vendors to gain access showed vulnerabilities to cyber threats and attacks. That's because conventional VPNs essentially create a bridge between networks, providing users widespread access to everything on the network. This posed significant security threats as the breach of any individual computer — whether an attorney, law firm staff member, or vendor — could put a law firm's network and data at risk.

How can law firms benefit from zero trust?

The rise in cyberattacks and breaches within the U.S. and worldwide has catalyzed many law firms to move to the cloud. Within a cloud environment, selecting a platform that employs the principles and architecture of basic zero trust is critical. Not only does the zero-trust principle of identity as a perimeter aid in preventing breaches, its modular and layered architecture means that access to information is protected and restricted even if a breach occurs.

The zero-trust architecture ensures that security breaches are contained and minimized, protecting a law firm's sensitive financial data. It also means that law firm clients' sensitive case and financial materials are also fortified and protected. These modern security practices not only protect confidential financials and other materials; they also protect law firms from the monetary fallout and legal liability they could face should such a breach occur.

How to rearchitect for zero trust

1. Implement modern authentication models

The principles inherent in zero-trust architecture are complex and multi layered. This is especially true when looking at modern authentication models — like SAML and OAuth 2.0 — used to establish trust and validate identity. These authentication mechanisms rely on token-based methods that protect and limit access and must be reimplemented across the entire application environment.

2. Implement the principle of least privilege

In addition to modern authentication models, the zero-trust principle of least privilege relies on the modularization of data with smaller containers of permission and varying levels of access. Least privilege helps ensure that a user only has access to specific data and resources, even if a breach occurs.

3. Test, analyze, and verify

Zero-trust attributes like modern authentication and least privilege are vital to preventing, detecting, and neutralizing cyberattacks and breaches within a cloud environment. But it's important to know that these modern security applications cannot simply be bolted on or added to existing legacy security systems. They must be rearchitected and integrated within technology — a process that requires extensive testing, analysis, and verification.

Be aware that when choosing a lift-and-shift solution, the existing security controls may not be optimized for the cloud environment and may not be able to take advantage of the native security features delivered by the cloud provider. Whereas with choosing a cloud-native solution, zero trust can be used to implement a comprehensive security strategy that takes advantage of the native security features available from the cloud provider. For example, a cloud-native solution's agility, flexibility, and scalability ensure that it can quickly adapt to changing business requirements and, most importantly, to security threats. This means security controls remain effective in a rapidly changing environment.

Zero trust in a cloud environment with 3E

For forward-thinking law firms, a move to the cloud is strategic and affords boundless opportunities for scalability and growth. But the cloud environment also requires modern ways of thinking and operating. This is especially true regarding security and ensuring that a firm's cloud-based financial and practice management system integrates zero-trust principles and architecture.

The world's most innovative large and midsize law firms trust 3E to run their mission-critical financial and practice management operations. Our tech is cloud native and built to take advantage of all the cloud has to offer now — and all the new technology to come in the future. Yes, a fully cloud-based platform with zero trust is an investment. But in today's competitive legal landscape, it's a necessity that law firms and their vendors must prioritize. The modern cloud service of Thomson Reuters 3E was built with zero trust in mind. 3E enables large and midsize firms to drive operational efficiency, growth, and profitability through its advanced architecture.