Security

Wise Owl Legal takes many precautions to safe-guard the security of your data stored in an Appliance. We treat your data like gold and try to go beyond current industry standards (where possible) to ensure your data does not fall into unauthorised hands.

However, it is important to note that we cannot give guarantees regarding data security. While Wise Owl Legal has implemented a variety of security safeguards, the nature of IT security is such that just one slip-up by a programmer, designer, or end user may result in data being disclosed to unauthorised persons. That is, Wise Owl must get security right 100% of the time, without fail. 

Why So Much Security?

Users and administrators of other legal software packages may by surprised by the amount of time and effort Wise Owl Legal has put into security. However, we believe the integrity and secrecy of the data stored within Wise Owl Legal Appliances is of paramount importance. There have been a number of high profile devices and websites compromised and sensitive data disclosed in the past few years, including personal details (with credit card numbers), passwords, public infrastructure (think power plants or heavy industry), media (US media companies have been experiencing attacks from Chinese government agencies) and the (in)famous WikiLeaks. We do not want Wise Owl Legal to be added to this list, nor your client's legal history to be found for sale on the black market.

Malicious attackers are cunning, incredibly patient and may be highly funded. They are interested in a variety of data typically stored in Wise Owl Legal Appliances such as personal contact details, personal history contained in matters and documents, passwords and financial records. This information can be traded in underground black markets, or may simply be posted publicly as a kind of trophy or badge among other hackers. Given enough time, resources and sufficient motivation (which may not always be strictly financial), a malicious hacker stands a real possibility of stealing data from a Wise Owl Legal Appliance.

Humans are notoriously bad at keeping secrets, choosing appropriate passwords and opening obviously dodgy emails. The human factor is one of the most common ways passwords are stolen these days (using emails and websites designed to look legitimate, but are actually run by hackers). Once an attacker knows a password, they can access a user's account and take whatever that user has access to. 

Finally, there is the tried and true approach of break-and-enter. A Wise Owl Legal Appliance is small, easily transportable, and could easily be stolen by a malicious attacker if they thought it brought enough benefit.

Wise Owl Legal has taken steps in all the above areas to prevent data being stolen.

We also use a layered approach, wherever possible, to mitigate the scope of data which may be stolen if one layer is broken. For example, if a user's password is guessed, the attacker will only have access to some of the data on the Appliance.

Online vs. Offline Appliances

Appliances are configured in either Online or Offline mode. When in Offline mode, the Appliance is only accessible from a local network (usually your office) and denies access to any attempt to connect from the Internet. Online mode allows connections from any Internet address, but must implement stricter login policies.

If your Appliance is kept in our data centre and you access it remotely, your Appliance is in Online mode.

Additional Security for Online Appliances

Offline appliances simply reject any login attempts from outside your network (technically, they reject any network connection at all). However, this is not particularly convenient when you are at client's premises or in a courtroom. Online access allows full access to Wise Owl Legal from anywhere on the Internet. To reduce the possibility of a malicious hacker gaining access, the following procedures are implemented:

• Only trusted computers and web browsers are allowed to login. When you first login from an untrusted computer or browser, you will be required to enter a code.

• Codes are generated either on your mobile phone or sent via email. If a hacker attempts to access your account, even if they know your password, they need access to your email or phone as well. This is called two factor authentication, because you need two things to login (your password and access to your email / phone).

SSL Certificates and HTTPS

All data sent and received by Wise Owl Legal Appliances are always protected using SSL and HTTPS. This is what's commonly known as a secure connection. It is the same technology used by banks, online retailers, and Google to ensure unauthorised 3rd parties cannot spy on your data as it travels across the Internet.

This protects against "man-in-the-middle" attacks; that is a 3rd party (often an ISP or government entity) which observes everything you send and receive to Wise Owl Legal.

It also ensures that the Appliance you're connecting to really is the correct one. This protects you against hackers who set up 3rd party sites which look like Wise Owl Legal, but are actually stealing your password.

Depending on how your Appliance is configured, you may have an SSL certificate issued by a 3rd party such as VeriSign or one issued by Wise Owl Legal. There is no difference in security between the two, however 3rd party certificates have an annual cost, while Wise Owl certificates require an additional step to configure web browsers (TODO: doco for trusting the Wise Owl root cert, similar to /wiki/spaces/IN/pages/228264241).

Whole Appliance Encryption

To protect against the theft of an Appliance, the entire Appliance is encrypted using Microsoft BitLocker technology. If someone steals your physical Appliance, they will require a USB key (or 40 digit code) to access it.

Important: when using your Wise Owl Legal Appliance, it is essential you do always remove the BitLocker USB after the Appliance is rebooted. This USB key must be stored securely apart from your appliance; if a thief obtains your USB key and your Appliance, they can access all the data stored on it.

Appliances in our data centres are also encrypted using the same technology, but to ease administration, may use a network based key rather than the physical USB key.

Passwords

Secret passwords are the main defence any website or appliance has to ensure only authorised users get access to it. Unfortunately, a bad password is only slightly better than no password (and provides a false sense of security).

Admin Accounts

Wise Owl Legal configures every Appliance with unique, strong administrator passwords during initial configuration (unlike many devices on the Internet). Remote support accounts must obey the same strict security rules that any other user working outside the office must obey. The underlying operating system follows established best practises and has a unique, strong admin password. They are no open back-doors for attackers to enter by. 

Password Storage

Passwords are stored in a form which cannot be read unless you know the password itself. Additionally, to make discovery more difficult if an attacker were to gain access to the encrypted passwords, Appliances apply the encryption routine many thousands of times. Technically, Appliances use the PBKDF2 SHA1 hash algorithm with a minimum of 5000 iterations (more on higher end Appliances).

Poor Password Choice

Poorly chosen passwords are the number one cause of accounts being compromised (with re-using passwords between multiple accounts a close second), rather than imposing complicated rules of upper case, lower case, number, length and so forth. We maintain a large list of black listed passwords (there are several million bad passwords on the list). This list is derived from a variety of sources including dictionaries and lists of names, but most importantly, we include long lists of leaked passwords from sites such as LinkedIn and RockYou. Finally, we use the same tools password hackers do to verify that passwords are not easily guessable. How to make a strong password. 

Two Factor Logins

All Online Appliances require two-factor logins to gain entry to them. This means you need to enter a code generated by a smart phone app, or emailed to you to login as well as your normal password. This means that even if an attacker can guess a password, they cannot login.

Restricted User Access

Each user in Wise Owl Legal has limited access rights. That is, most every day users cannot access all the data on the Appliance, only privileged administrative users. In particular, rights to do Appliance wide data exports are not granted to ordinary users. This mitigates the data available to a hacker if ordinary user accounts are hacked.

This means users with higher access rights should use stronger passwords. If a high level user account, such as a company director, is hacked, this mitigation will not be effective.

The system users in the underlying operating system are also highly restricted. They cannot access sensitive operating system level files and resources, only the data required for Wise Owl Legal. This can restrict the possible damage which may be done by operating system level security issues, and prevent a security issue in Wise Owl Legal itself being used to gain access to a system level account.

No SQL Access

No user in Wise Owl Legal is allowed to perform arbitrary SQL queries on the underlying database. This prevents bulk data dumps and other unauthorised data access. All data presented to users is via approved data models.

In addition, Wise Owl Legal Appliances use SQL query parameterisation to prevent one of the most common ways to access sensitive data: SQL injection. SQL injection is how most high profile data disclosure incidents have occurred. Also, no connections to the SQL database are permitted from outside the Appliance.

Audit and Application Logs

Finally, in the event an attempted or actual security breach does occur, Wise Owl Legal appliances keep multiple logs of resource access. In particular, we are very careful to log information about login attempts (successful or otherwise) including the web browser used, and IP address.

Logs include:

• Low level web server logs (only accessible by Wise Owl Legal Helpdesk staff)

• Appliance level system logs (accessible from the Tools page)

• Audit logs (accessible from the Tools page)

• Profiling and metrics (access level TODO)