As legal professionals operating in the digital age, we are all too aware of the ways in which we might inadvertently invite a breach into our firms. The recently published “Legal Tech Lists” from Above the Law has identified seven key practices that may be putting law firms at risk.
- Not Adopting Multifactor Authentication (MFA): The inconvenience associated with such an upgrade often deters law firms from implementing MFA, despite Microsoft’s assertion that adoption of MFA could prevent 99.9% of account takeovers.
- Lacking Multiple Backups: It’s crucial to understand that having more than one backup, not connected to the network, is essential for firm protection. Cybercriminals can easily access and compromise any single backup connected to a network.
- Skimping on Employee Training: Regular, adequate training to recognize potential cyber threats is a significant part of bolstering firm defenses against attacks. But, many especially solo, small, and mid-sized firms overlook this factor.
- Not Having an Adequate Incident Response Plan (IRP): Only 42% of firms have an IRP to deal with emergency situations. Moreover, many existing IRPs are outdated – having a robust and updated IRP is vital for handling breaches and potential penalties.
- Trusting without Verifying: It’s unfortunately common for employees to take sensitive firm data with them when they switch firms. Therefore, trust should be complemented by regular audits and password practices.
- Taking Work Laptops Abroad: Taking a work laptop overseas, especially to certain countries, increases the vulnerability of the data contained within it. It is safer to have clean laptops for trips abroad.
- Allowing Apps to Access Contacts: Many lawyers have apps with access to their contacts, potentially compromising sensitive data. Several bars have declared it unethical to allow apps such unrestricted access.
While these seven behaviours significantly increase the likelihood of breaches, avoiding them can enhance the cybersecurity protocols of your law firm.