Tessian spoke to Graham Thomson, CISO at leading law firm Irwin Mitchell, about his career and why he uses Tessian to keep Irwin Mitchell’s employees safe on email.
To get started, can you take us through how you first got into security?
I got my degree in genetics and then worked in military intelligence, where I received a grounding in computer security. After a few years, I left the military and got a job as an investigator for a global retailer. Initially this was to investigate fraud and corruption, but evolved to cover issues relating to information security, such as insider breaches and hacking.
Having decided that a career in information security was for me, I then obtained my CISSP qualification. I’ve since been lucky to experience many different industries, including insurance, online banking and e-commerce, and now the legal sector. I’ve been focused on purely information security for around 12 years now.
How has the industry changed since you began your career, and what has the impact of technology on security been?
Information security has changed hugely over time, probably because the threats themselves have changed. When I started out, I think it’s fair to say the work we were doing probably wasn’t that well understood.
When I was being trained initially, I remember learning about a KGB-initiated infiltration of systems that was discovered pretty much by chance: this was a real eye-opener that brought home just how important computer security was going to be in the modern economy.
One of the biggest changes is the focus on people. Previously, security professionals would be technical IT specialists, but today many different career paths – the military and law enforcement are just a couple of examples – can lead towards information security. The ability to understand an issue from the attacker’s point of view is very useful.
You can spend as much money as you want on technology, but at the end of the day there are humans with legitimate access to your systems; if they are negligent or abuse their positions, then there’s very little that tech can do to stop that.
What are your core responsibilities at Irwin Mitchell? And what are your ambitions for your department and the team over the coming years?
My core responsibility is setting the strategic security vision for the company and making sure we successfully deliver on our objectives. I refer back to this regularly to work out whether there are gaps in our present strategic framework, or whether we need to readjust priorities on particular technical projects.
It’s all well and good sitting and thinking about high-level problems, but real-world feedback really helps to crystallize the impact of what we’re doing. It’s my security policy, but I want to know how it translates across the business.
The key thing is that many people within law firms deal with very sensitive personal and company data. Our bread and butter is keeping this safe. Firms in other sectors may only have a few people dealing with sensitive data, but in law firms the proportion of people in the business who have this responsibility is far higher.
This information isn’t just internal, it comes from external parties too. For example, we might have sensitive medical records or information relating to military matters as part of the work our solicitors do.
The legal space is a fairly unusual sector in that we have to think about security in a very broad sense. The very term ‘cybersecurity’ reflects the fact that more and more of the information people consume is digital. But working at a law firm, there are paper records that have to be dealt with too. So my role depends on understanding and managing all the implications of information security, not just the technical aspects.
It’s important to remember that our people could be very experienced lawyers or new graduates: we have to make sure that everyone understands what their security responsibilities are. People have to know how to handle information from when it comes into our orbit right through to when we dispose of it.
Security can’t just be a case of asking people to read a lengthy, technical policy document. I have to ensure the information is relayed in a way that’s meaningful, interesting and relevant, and I need to make sure the technical tools we use are easy to understand.
How can new security technology help the legal sector really make strides in the years to come?
The first thing to say is that the legal sector has probably not moved as fast as some other sectors when it comes to adopting technological solutions. Although there are some startups making strides in ‘legal tech’, fintech, for instance, has a higher profile and potentially more innovation happening in that space right now. Things are improving, but the sector has a whole has possibly been slightly behind the times.
For me, where the sector could really benefit is access to justice: I think tech will help ordinary people engage more meaningfully with the legal system. Law is complex, and there are so many gray areas, but I’m hopeful that developments in artificial intelligence (AI) hold a lot of promise.
It’s never a good thing when someone decides not to approach a lawyer or a law firm because they’re not sure whether it’s worth it or because they think the process will be particularly laborious. Tech that allows people to ask initial questions without having to directly engage the services of a human lawyer could mean that people find it less intimidating to approach law firms.
I think we’re now moving past the point where people expect to have to walk into a physical office to have meaningful conversation with a legal professional. You could easily get the same result from your own home, or on your phone, and that kind of relationship is what we need to be thinking about.
I also think there could be major benefits to research. When paralegals need to sift through thousands of pages, AI could help surface the relevant information more quickly. Bots that do more labor-intensive work like reviewing long contracts could also save significant chunks of time.
Next-generation technologies like AI could definitely help the legal sector move forward. The danger with AI though is that biases may still come into play, as is often the case when dealing with complex algorithms.
Can you tell us about your experience bringing new technologies into a law firm?
I’m fortunate that today, cybersecurity is taken very seriously at board level. If I can show that there’s a requirement and a potential benefit with a new piece of technology, the appetite to mitigate that risk is usually there.
When it comes to end users, we have to think carefully about altering processes they might be used to, or telling them to stop doing something that seems innocuous. I’ve found that as long as the training and awareness is communicated well, it’s usually accepted without too many hiccups.
Interestingly, when we implemented Tessian Guardian, which helps us combat misdirected emails within the organization, it was one of the few security products where we had no complaints about it. In fact, people sent us screenshots thanking us for preventing emails potentially going to the wrong destination! It’s great for the team to feel like we’re making positive changes within the organization.
Could you describe Irwin Mitchell’s attitude to information security in a couple of sentences?
Our people see information security as an absolute necessity when it comes to doing business. Everyone acknowledges that they share responsibility for the firm’s success or failure here.
So how important is Tessian to your overall security stack?
Tessian is critical for us. Misdirecting an email is very easily done: people want to be productive, and they don’t always notice when autocomplete gives them an incorrect email address. Tessian also gives us great analytics and reports which help us actually analyze the data, over and above the solution itself.
We’re soon going to be implementing Tessian Defender, which will help us address inbound spear phishing threats and make Irwin Mitchell’s security structure even more secure. Tessian is just a very clear way for us to communicate potential risks and give our colleagues additional protection.
*Interview condensed from Modern Law Magazine supplement, May 2019.
