On March 22, 2021, the California Supreme Court updated California’s Rules of Professional Conduct. Rule 1.1, Competence, comment 1, now requires California attorneys to know the risks of the technology used in their legal practice, such as cyber threats and cybersecurity issues. This makes California the thirty-ninth state to incorporate a duty of competence with technology. Bob Ambrogi, “California Becomes 39th State To Adopt Duty Of Technology Competence,” LawSites, Mar. 24, 2021; see also Tech Competence (map and linked list of state rules), LawSites. The following article is not an article per se; rather, it’s a cheat sheet for newly minted and seasoned attorneys on best cybersecurity practices for the legal field.
By using lower- and upper-case letters, numbers, and special characters, you can greatly increase the complexity of a password. Please be advised that smarter password-cracking programs would go through the commonly used passwords first, use dictionary-word password algorithms, and use any known encryption or hashing algorithms exploits, birthday attack probability theory, and much more. The birthday attack is a probability theory that two or more completely different passwords could provide access to a service due to different passwords producing the same access granted key under probability theory. This is named after the phenomenon that in a room of 30 people, the probability that at least one person would have the same birth month and day as someone else is about 70 percent. The concept is that, at first glance, it does not seem likely to happen, but it is likely to happen if you break down the probability.
The following are estimated times for cracking passwords through brute force methods (a password-cracking program that goes through every character) in the year 2022.
“How Long to Hack my Password,” Ramdom-ize. (These times are estimates at best and do not incorporate hardware, software, and network optimizations.)
Note that if you are using dictionary words or common phrases for your passwords, then a smart password-cracking program would check for those, such as “password1,” “letmein,” “avocad0,” or “il0vey0u.”
The two best ways to maintain strong passwords are the following:
Never save your passwords through your web browser (Chrome, Edge, Firefox, etc.)! Passwords that are “remembered” or “saved” through the web browser are stored in plain text, and they can be easily accessible through the web browser. All you have to do is search online for “show *web browser* saved passwords” and you can easily find instructions to look up the saved passwords in a web browser.
Operating systems do have expiration dates, known as sunsetting or end of life. When operating systems reach their end of life, they often no longer receive any security patches or new features. Below are some sunsetting dates of popular operating systems:
Facebook, Instagram, and WhatsApp went down to the public from roughly 11:40 a.m. to 6:00 p.m. eastern time. Alex Heath, “Locked out and totally down: Facebook’s scramble to fix a massive outage,” Verge, Oct. 24, 2021. Reports also stated that this affected internal systems that disrupted employees’ abilities to communicate and work. This outage required Facebook engineers to visit the main U.S. data centers in California to manually restore services. Id. This was not as bad as when Facebook, Instagram, and WhatsApp went down for almost 24 hours on March 13, 2019. Thomas Ricker, “Facebook returns after its worst outage ever,” Verge, Mar. 14, 2019.
Amazon Web Services (AWS) cloud servers went down from 10:45 a.m. to 6:00 p.m. eastern time. Richard Lawler, “An Amazon server outage caused problems for Alexa, Ring, Disney Plus, and Deliveries,” Verge, Dec. 7, 2021. AWS are virtual webservers hosted by Amazon that help various internet companies to function online with video streaming and other online processes. The affected services included Netflix, Disney Plus, Alexa AI Assistant, Kindle eBooks, Amazon Music, Ring and Wyze, Tinder, Roku, Venmo, Amazon Flex, Amazon warehouse machines, and work apps for Amazon delivery workers. Id.; Richard Lawler, “Amazon outage isn’t just online: delivery vans and warehouse bots aren’t moving packages,” Verge, Dec. 7, 2021. The horror. . . . The horror.
Kosovo banned cryptocurrency mining to try to prevent more rolling blackouts. “Kosovo bans cryptocurrency mining after blackouts,” BBC News, Jan. 5, 2022. This happened after a declared 60-day state of emergency in December 2021. Id.
North Korea suffered numerous internet outages for almost two weeks. . . . That was caused by one American person known as P4x, who hacked the country’s internet. Andy Greenberg, “North Korea Hacked Him. So He Took Down Its Internet,” Wired, Feb. 2, 2022. North Korea spies reportedly hacked P4x while they were primarily targeting western security resources to steal hacking tools and software vulnerabilities. Id. P4x used distributed denial-of-service (DDoS) and other vulnerabilities to attack North Korea’s internet infrastructure and its own national homebrew operating system, Red Star OS. Id.
