Law Firm Cybersecurity Best Practices

Today, a hacker can access great volumes of data from anywhere in the world, limited only by the speed of the connection and the size of their hard drive. Also, specific documents themselves are searchable and easier to locate.

Moreover, a hacker can be in and out of your law firm’s system without you ever knowing about it, and without leaving any clues behind. As a result, the implementation of law firm cybersecurity best practices has become a top priority for law firms of all sizes.

Your ethical and regulatory obligations to protect client data

Your law firm’s responsibility to protect its data is a measure of its ethical and regulatory obligations. Firstly, you owe your clients a standard of care that includes taking reasonable steps to protect their privacy and to keep their personally identifiable information confidential.

Secondly, every state has adopted legal ethics rules based on the Model Rules for Professional Conduct (MRPC), which has two distinct rules applicable to the issue of cybersecurity for law firms:

1. Rule 1.15 – Safekeeping Property; and
2. Rule 1.6 – Confidentiality of Information

The MRPC is not regulatory, but since all U.S. jurisdictions use some version of the rules, it is important for lawyers who have passed the Bar in multiple states and practice across states to make sure to carefully review the MPRC and its counterparts in the various jurisdictions where they will practice.

This is why the Multistate Professional Responsibility Examination (MPRE), which tests one’s knowledge of the American Bar Association’s Model Rules of Professional Conduct and Model Code of Judicial Conduct, is one of the exams required for admittance to the Bar in most states.

Lastly, each state has its own statutes and laws governing data security and privacy. These rules focus on safeguarding consumer data and generally require law firms to take reasonable steps to protect consumers’ personally identifiable information and to notify impacted consumers whenever a data breach occurs.

Best practices for law firm information security

The information security risks that law firms face may have changed dramatically with the growth of technology, but there are still steps that you can (and must) take to counter these risks. We recommend the following law firm cybersecurity best practices for all law firms:

Know what threats you are facing

Cyberattacks come in a variety of different ways, including:

• Ransomware;
• Denial of Service (DoS) attacks;
• Data theft;
• Man-in-the-middle attacks;
• Phishing attacks;
• Password attacks; and
• Viruses, worms, and bots

When it comes to cybersecurity, the best defense is a good offense. This starts with discovering the various types of cyber threats to which your law firm may be vulnerable.

Train your team on what to look out for

While it may seem counterintuitive to approach cybersecurity from outside your IT, it is often necessary to address your biggest security risks—your own staff and employees.

We recommend training your employees to keep an eye out for the following legal IT security risks:

• Falling for phishing scams;
• Mishandling customer data;
• Sending sensitive information via email; and
• Password management

Use multi-factor authentication (MFA)

This essentially means implementing one or more additional layers of security after a user enters their password, for example:

• Requiring the user’s fingerprint;
• Requiring the user to insert a token or smart card into the computer;
• Sending a code or push notification to the user’s phone, commonly referred to as a One-Time Password (OTP); or
• Verifying the user’s identity using a digital certificate, also known as Client Authentication.

MFA capabilities are another aspect of a good practice management system and a core component of a strong law firm data security policy.

Keep your software updated

Every IT system in your law firm, whether you are using different internet browsers, desktop apps, or operating systems, will have potential vulnerabilities. Furthermore, new vulnerabilities are discovered every day.

The only way to avoid falling victim to these threats is to keep your software updated at all times. With a cloud-based practice management solution, updates and security patches will automatically be installed with very little disruption, if any, to your practice’s operations.

Consider S / MIME for email security

S / MIME, which stands for Secure / Multipurpose Internet Mail Extensions, is an open standard for signing and encrypting emails. It uses public and private keys composed of long sets of numbers and letters, much like passwords.

When an email is sent, the message is encrypted using the recipient’s public key, and can only be decrypted by using the recipient’s private key. The email being sent is also signed by the sender’s private key to provide the authenticity of the message to the recipient.

Encrypting emails using S / MIME ensures only the intended recipient can access its content. This means that even if a hacker intercepts the email in transit, or gains access to your mail server, they still won’t be able to read them.

S/MIME also allows you to digitally sign emails, which can help counteract the growing risk of phishing attacks and compromised emails by verifying the origin of a message. This will make it easier to spot a spoofed email.

Consider a cloud-based solution with an integrated client portal

Locally installed legal practice management solutions can make it difficult to provide access to an increasingly mobile workforce. Furthermore, they are often difficult to install and maintain.

A cloud-based legal practice management solution with an integrated client portal may be a better solution for the following reasons:

1. There will be no need to purchase and maintain expensive on-site servers, which can also lead to cost savings related to IT services;
2. You can keep all of your law firm’s data safe in a completely managed environment with multiple layers of security;
3. Your data will automatically be backed up, reducing the risk of data loss from things like natural disasters or cyber-attacks;
4. Your staff will be able to access the system from virtually anywhere and from any device; and
5. Client portal technology can avoid the need to ever email clients over unknown servers.

Make cybersecurity a top priority at your law firm

Though the risks may have changed over time, a law firm’s duty to protect its sensitive data is the same today as it has ever been. If you haven’t made cybersecurity a top priority at your law firm, now is the right time to do so. CARET Legal uniquely provides legal practice management solutions and managed services that will take care of many of your law firm’s cybersecurity needs for you.