The Technical Debt Standard: Impact and Consequences

Standard business decisions in software, outside of the realm of immediate legal liability to law firms, introduce continuous risk into firm operation, necessitating technological cybersecurity standards.  The technical debt standard is a way to conceptualize unseen risks to law firms. Technical debt, in this case, is the development of new program features, such as on a PC operating system, which are prioritized over fixing old issues. ¹ Like financial debt, it incurs interest in the form of increased maintenance costs and complexity over time. ² Furthermore, high amounts of technical debt accrued over time weaken the cybersecurity posture of critical technologies, burdening companies, clients, and creditors in the same way as bankruptcy proceedings might.

In our client analysis of technical debt, the we describe several tranches of how security vulnerabilities accrue in software:

• 0-1 years: These programs are frequently updated and in active development, making them easy to patch or fix.
• 1–5-years: When software fall out of routine update over this period, causing lingering errors that have not been fixed due to expense or feature priorirization.
• 5-10 years: For software that is aging, code refactoring to fix long-term errors may be required at a high cost.
• 10-20 years: We classify these as ‘End of Life, Long term Support’ when categorizing these programs. These programs contain errors and vulnerabilities that are unable and unlikely to be fixed requiring new software products and accompanying proceses.

A common misconception among people without software expertise is that software and operating systems are updated and are eventually replaced with newer versions; Windows 95 to 98, then 2000, XP, Windows 7, etc. This preconception belies the reality that the architecture of many software platforms from email services, to internet protocols, webpage browsers, and even legal software, are layered on top of old versions that carry over the same security vulnerabilities from generation to generation. ³ These vulnerabilities are not limited to PC software. As of writing, the National Vulnerability Database has detailed an Apple IOS software vulnerability that approximately 33% or around 40 million iPhones are exposed to. ⁴

Vulnerabilities in the underlying software of multiple platforms represent a threat to the firm required to operate across them.  Client proprietary and privileged digital information cannot be protected by updates to the Rules, nor can the attorney’s work product. Proposals to keep up with regular patching and software updates, in addition to training on best practices, may weed out the 96 to 97% of common attacks that employ simple hacking techniques. ⁵ This kind of training does not address the underlying technical standards that law firms should use for the final 4% that is primarily the domain of technical subject matter experts and third-party providers of cybersecurity solutions. One of the clear dangers in this lack of standards is the penetration of third-party data aggregators that law firms rely on for research, such as LexisNexis. In 2013, a hack of LexisNexis resulted in a breach that was most likely accomplished through a legacy software failed update. ⁶ In a similar attack by the same hacking group, the attackers broke into the server using a recently patched weakness in Adobe Cloud Fusion, a piece of legacy software that powered their servers. ⁷ In basic terms, attacks of this nature are possible because the websites rely on legacy software that can be hacked using unpatched exploits. A report by Enlyft states that 1435 law practices and 768 related legal service providers use LexisNexis for their services. ⁸ This hack represents an important indicator of the importance of the technical debt standard for one reason above all: LexisNexis is a large technical provider of data aggregation and has a much deeper data security apparatus than a given law firm would have. The fact that such a large third-party provider of legal services indicates an alarming lack of security standards for the legal practitioners who utilize such services. Technical standards for cybersecurity practice are badly needed to alleviate these issues. To learn more about how CLR Technologies utilizes the technical debt standard to ensure your firm’s security posture, please see our options below.