Managed IT and security for law firms
When a law firm is breached, the ethics rules come into play.
What clients tell you ends up in firm email, in the document management system, and in the cloud tools wired into both. Trust funds and settlement money travel over the same systems. When those systems fail, you have three problems on the same day: telling clients, exposure to a malpractice claim, and what you owe the bar.
A 30-minute call. Straight answers. A short list of what to do next.
The duty does not pause for an outage
Attackers come to a law firm for two things. One is money on the move: funds for a closing, a settlement payout, a disbursement from trust. The other is the privileged material sitting in email and the document system.
Either way, the usual method is business email compromise, and it takes very little skill. A hijacked mailbox, a domain one letter off, or simply a well-written message will do, provided the reader is busy and the request looks routine.
The duty to protect client information makes no exception for a security project the firm had not finished. The incident arrives, and the obligation is already there waiting.
Four places a firm’s files and funds are at risk
Trust accounts and wire transfers
Settlements, closings, and disbursements move through IOLTA and other trust accounts. The amounts are big and there is always a deadline, which is why fake wire instructions are aimed here.
Email is the channel through which firms lose the most client money and the most confidential material. One partner’s mailbox in the wrong hands, or one imitation domain, can leak a file or send a payment elsewhere. Days can pass before the firm finds out.
The document management system
This is where the agreements, pleadings, discovery, and client letters live. If more people can open a matter than need to, the firm carries a permanent risk that never sets off an alarm.
Personal devices, outside counsel, and backups
The same privileged material is on attorneys’ personal phones and laptops, in backup copies, and with the vendors and co-counsel who share a matter. Much of that is outside the firm’s direct oversight.
Signs a law firm has a gap
Permissions in the document system have gone unreviewed since the day it was set up.
When wire details arrive for a settlement or closing, the only check is a reply to that same email.
Outside counsel and vendors still have access to matters that closed years back.
MFA is on for some systems and off for others, and nobody can say which.
Attorneys work from personal laptops and phones that the firm does not manage at all.
Some answers on the most recent cyber insurance application were estimates.
Common questions
We are a small firm. Do attackers really care about us?
They do. Boutique and mid-sized firms are regular targets. They hold valuable trade secrets, M&A information, and trust account funds, and they usually do not have the enterprise-grade security a large firm has.
What do the bar rules say about cybersecurity?
The ABA Model Rules are the basis in most states. Under Rule 1.6(c), a lawyer must make reasonable efforts to prevent unauthorized access to or disclosure of client information. Comment 8 to Rule 1.1 brings the benefits and risks of relevant technology within the duty of competence. ABA Formal Opinion 483 covers what a lawyer owes after a breach, notice to current clients included. The rules and breach statutes of your own state are what govern, so check the details with your bar. We do not give legal advice. What Defendrs provides is the technical safeguards, and the records of them, that back up those duties.
Our practice-management vendor takes care of security, right?
For its own application, yes: the hosting, the code, and the sign-in. It cannot reach the firm’s email, the personal devices attorneys use, or the outside parties who have been let into a matter. The vendor leaves those unguarded, and they are usually where a problem starts.
We already have IT support. What does Defendrs add to that?
General IT makes sure the printers work and the legal software stays current. Specialized cybersecurity defends the practice from targeted phishing, breaches of client privilege, and regulatory compliance problems, none of which ordinary IT support was set up to deal with.
Confidentiality is a promise the firm made. Check that its systems can keep it.
A client hands you things they tell nobody else. Give us 30 minutes and we will tell you whether the firm's technology is up to holding them.