Secure Password and File Sharing for Federal and State Courts

U.S. court employees need to access dozens of systems and applications in order to complete their duties. These employees may also have access to Personally Identifiable Information (PII), which must be securely stored and managed with strict access controls. Court systems need a way for employees to easily and securely access systems, and share passwords and files among teams.

Keeper Security Government Cloud (KSGC) is a FedRAMP and StateRAMP Authorized password and privileged access management system. It is used by dozens of state and federal court systems to secure passwords and credentials, while enabling the secure sharing of passwords among teams and with relevant third parties. 

Why Are Courts Targets for Cyber attacks?

Cybercriminals look to gain access to sensitive data so they can encrypt the files and demand a “ransom” for the decryption key. This is known as a ransomware attack. U.S. court systems have a wealth of confidential data about individuals and organizations, including PII, such as Social Security numbers and bank account numbers. However, court data isn’t limited to PII. There is also case information, which could include:

• Confidential informants and search warrants in criminal cases
• Victim information in domestic violence and sexual assault cases
• Family court files involving minors and families
• Medical and psychological reports
• Testimony within sealed transcripts and recordings
• Trade secrets
• Jury and grand jury records

Court officials are particularly worried about ransomware attacks – and for good reason. The cost of ransomware attacks in government often runs into the millions of dollars, which mostly stems from downtime and recovery (or in some cases, paying the ransom). It could take days or weeks to restore systems after an attack, grinding court operations to a halt. Additionally, courts may be targeted by someone seeking revenge for an unfavorable case result, or as an attempt to destroy evidence or modify judgments.

State courts in Alaska, Georgia and Texas have experienced cyber incidents in recent years. In May 2020 a ransomware attack hit Texas courts, affecting servers at each of the state’s two high courts and at its 14 intermediate appellate courts. Casey Kennedy, CIO for Texas’ Office of Court Administration, said the hackers likely used a phishing campaign to take over a regular user email account, then used a software vulnerability to grant administrator-level privileges to the account.

Georgia’s court system experienced a ransomware attack in 2019 and had to take systems offline to recover. With no electronic access to criminal cases and traffic citations, clerks had to use paper records, and many courts had to reschedule court dates.

The Alaska courts’ ransomware incident happened in 2021. Alaska had to take its court system completely offline for about a month to ensure the perpetrators were fully removed from the network, then work to rebuild systems, improve security and restore data from backups.

Who Needs Access to Credentials?

Courts have a lot of employees including judges, court clerks, attorneys, paralegals and other administrative assistants, court reporters and jury administrators. These employees need access to a varying number of systems as well as case data. There are also instances where confidential files need to be shared externally. For example, a judge may need to share certain case information with an outside party, such as a defense attorney.

Judges and staff have access to court systems and PII. These employees often use laptops, tablets and smartphones to conduct court business. Entry points that cybercriminals can exploit can include case management systems, networks, servers, cloud storage, software programs, WiFi systems and other court-specific technology. The large number of endpoints or devices, coupled with a multitude of entry points increases the attack surface and risk of breach.

Court systems need to ensure their data is secure and that sensitive data is only shared with those who truly need it to do their job. Unfortunately, court system IT teams often have limited budgets and staff to address security shortfalls.

Password Management for Courts

Stolen and weak passwords are the leading cause of data breaches, yet most court systems have no visibility, security or control over their employees’ passwords and credentials. Judges, lawyers and court employees have varying levels of technical knowledge and security training. As a result, these employees may end up making poor password decisions that don’t adhere to best practices.

Keeper Security Government Cloud (KSGC) helps all employees create strong, unique passwords for all their accounts and store them in a secure location. KSGC uses Role-Based Access Control (RBAC) to provide complete visibility and control over identity security and risks within a state or federal court organization. Administrators can enforce Multi-Factor Authentication (MFA), which requires users to provide more than one form of authentication to access a service or application. Keeper offers seamless integration with popular Single Sign-On (SSO) solutions, such as Microsoft Azure and Okta, and Smart Card Authentication, such as the DoD’s Common Access Cards (CAC) and the federal government’s Personal Identity Verification (PIV) cards.

KSGC uses role-based enforcement policies for sharing passwords, and also a feature called One-Time Share. This sharing option allows users to securely share a record with someone, even if they don’t have a Keeper account. When using One-Time Share, a link is created that allows users to choose the amount of time that they wish to make a record available. The link is locked to one device, meaning a recipient can not forward the link or even open it on a separate machine. 

Lawyers use this feature when sharing case data that only needs to be viewed by a third party for a specific amount of time. Once that time expires, access to the record is revoked. Users can also manually revoke access to the record at any time. 

Role based access controls within KSGC allow teams to only share passwords when needed. The admin can restrict the levels of access and permissions for teams, users, roles and shared folders. KSGC admins can also enforce One-Time Share permissions via RBAC. 

Privileged Access Management for Courts

Privileged Access Management (PAM) refers to managing and securing accounts that have permissions to access highly sensitive systems and data, such as IT administration accounts, payroll systems and code repositories. Court system users who may need privileged access include system and account administrators, judges, HR professionals and finance employees.

There may also be instances where vendors or other third parties need access to IT systems. For example, many court systems use large software vendors for their database management. These systems are complex and need to be maintained by the software company rather than the court’s IT team. Instead of sharing the passwords to these critical systems, a privileged access management solution can grant vendors remote access without having to explicitly share passwords. The session can be recorded (for auditing or compliance purposes) and access can be set to expire at a certain time.

While privileged access management can manage and secure privileged credentials, traditional solutions are often cost-prohibitive, difficult to deploy and contain unused features. Keeper Security Government Cloud is a FedRAMP Authorized password manager and privileged access manager that addresses the key pain points and requirements in organizations to prevent data breaches with just the features you need.

• Cost Effective: A single platform with minimal IT staff required to manage it
• Fast Provisioning: Seamlessly deploys and integrates with any tech or identity stack in just a few hours
• Easy To Use: Unified admin console and modern UI for every employee on all device types – average training time is less than 2 hours

Nearly half of all federal court systems trust Keeper to protect them against cybercriminals. To learn more about Keeper Security Government Cloud and how it can strengthen your organization’s cybersecurity, request a demo today.