legal information security training security threat analysis court lawyer attorney penetration testing network security law security vulnerability judgment security audit information security policy security security risk assessment information