Cybersecurity for Law Firms

Law firms hold information that clients expect them to protect: financial records, personal information, contracts, legal strategies, intellectual property, privileged communications, and settlement details.

That information moves through email, cloud applications, laptops, mobile devices, legal software, and third-party vendors. Each system creates another potential point of exposure.

According to the ABA’s 2023 Cybersecurity TechReport, 29% of respondents reported that their firms had experienced some form of security breach. The ABA cautioned that a security breach, such as a lost device, is not necessarily the same as a confirmed data breach. The distinction matters, but the finding still demonstrates how common security events have become in legal environments.

Why Law Firms Face Distinct Cybersecurity Risks

Law firms combine valuable information with time-sensitive work. Attorneys and staff need dependable access to email, documents, calendars, practice-management systems, and client information. When those systems are disrupted, the consequences can include missed deadlines, lost productivity, delayed client work, and difficult reporting decisions.

Legal teams also work from offices, homes, courtrooms, client locations, and mobile devices. That flexibility makes secure identity, device, and access management especially important.

The objective is not to make legal work unnecessarily difficult. It is to establish protections that allow attorneys and staff to work efficiently without exposing client information to avoidable risk.

Common Cybersecurity Threats Facing Law Firms

Phishing and Business Email Compromise

Phishing messages attempt to persuade employees to disclose credentials, approve fraudulent payments, open malicious files, or visit unsafe websites.

Legal professionals may receive convincing messages impersonating clients, courts, vendors, opposing counsel, executives, or technology providers. A compromised email account can also be used to send believable messages from a legitimate address.

Email filtering and authentication help, but they cannot replace employee awareness, verification procedures, and a clear method for reporting suspicious messages.

Stolen Passwords and Account Takeovers

A correct password does not prove that the person signing in is the authorized user. Passwords may be stolen through phishing, malware, reused credentials, or fraudulent support calls.

Multi-factor authentication provides an important additional layer. Microsoft Entra Conditional Access can add further controls by evaluating the user, device, application, location, and sign-in risk before granting access.

Learn more in PCC’s Conditional Access guide.

Ransomware and Malware

Ransomware can encrypt files and disrupt the systems an organization depends on. Other malware may steal information, capture credentials, establish unauthorized access, or create a path for a larger attack.

The Cybersecurity and Infrastructure Security Agency identifies malware, phishing, and ransomware as common forms of cyberattack.

Protection requires more than installing a security product. Systems must be maintained, monitored, backed up, and supported by a practiced response process.

Unmanaged Computers and Mobile Devices

Attorneys may use laptops, phones, and tablets to access email and client information from nearly anywhere. A device that lacks encryption, security updates, endpoint protection, or access controls can expose firm information.

Mobile device management can help establish consistent requirements, protect business applications, and remove firm information when a device is lost or an employee leaves.

Read more about Mobile Device Management for Law Firms.

Unsafe File Sharing and Microsoft 365 Configuration

Microsoft 365 can support secure collaboration, but its protection depends on how identities, permissions, sharing, applications, and security controls are configured.

Common problems include excessive permissions, broadly shared links, inactive accounts, weak administrator protections, and former employees who retain access longer than necessary.

Firms should periodically review who can access sensitive information, how external sharing is managed, and which security features are enabled.

Third-Party and Vendor Risk

Law firms often rely on practice-management software, document systems, eDiscovery platforms, cloud services, payment providers, and outside consultants.

A vendor may handle firm information or connect directly to firm systems. Before providing that access, firms should understand what information the vendor receives, how it is protected, who can access it, and what happens if the vendor experiences a security incident.

Employee Mistakes and Misused Access

Not every security event begins with a sophisticated attacker. Information may be exposed through a misdirected email, an overly broad sharing link, an unapproved application, a weak password, or access that was never removed.

Security controls should reduce the likelihood and impact of mistakes while giving employees a simple way to ask questions and report concerns.

What a Practical Law Firm Cybersecurity Program Includes

No single product can protect every part of a law firm. Effective cybersecurity uses multiple layers so that one failed control does not automatically expose the entire environment.

Identity and Access Protection

• Multi-factor authentication
• Strong administrator protections
• Conditional Access where appropriate
• Role-based permissions
• Regular access reviews
• Prompt employee offboarding

Email and Collaboration Security

• Phishing, malware, and impersonation protection
• Secure email configuration
• External forwarding controls
• Safe file-sharing standards
• Monitoring for suspicious account activity

Managed and Protected Devices

• Endpoint detection and protection
• Encryption
• Security updates and patch management
• Mobile device management
• Secure remote access
• Removal of business data from lost or retired devices

Backup and Recovery

• Backups appropriate to the firm’s systems and information
• Protection against unauthorized backup deletion
• Defined recovery priorities
• Periodic restoration testing
• Documented responsibilities during an outage

Employee Security Awareness

• Ongoing security-awareness training
• Phishing simulations where appropriate
• Payment and account-change verification procedures
• Clear policies for personal devices and applications
• A simple process for reporting suspicious activity

Incident-Response Planning

• Named internal and external contacts
• Procedures for compromised accounts and devices
• Methods for preserving relevant information
• Communication and escalation responsibilities
• Coordination with legal counsel, insurance, and other specialists
• Periodic review and testing of the plan

Cybersecurity and a Lawyer’s Professional Responsibilities

Cybersecurity is not only a technology issue. Lawyers must also consider their professional duties relating to competence, confidentiality, communication, supervision, and the protection of client information.

ABA Formal Opinion 477R addresses safeguards for communications involving protected client information. ABA Formal Opinion 483 discusses lawyers’ obligations after a cyberattack or data breach, including monitoring, stopping the event, restoring systems, determining what happened, and communicating with affected current clients when appropriate.

The State Bar of California’s Ethics and Technology Resources provides California attorneys with additional guidance about technology and professional responsibility.

Technology providers can help implement and manage safeguards, but they should not make legal conclusions for the firm. Each firm should work with qualified legal, insurance, compliance, and other advisers when determining its specific obligations.

Questions Law Firm Leadership Should Ask

• Do we know every account and device that can access confidential information?
• Is multi-factor authentication required and properly configured?
• Can unmanaged devices access firm email and files?
• Are administrators protected differently from ordinary users?
• How quickly is access removed when an employee leaves?
• Are Microsoft 365 sharing permissions reviewed?
• Can we recover essential systems and information after an incident?
• Do employees know how to report a suspicious message or event?
• Have we documented whom to call during a security incident?
• Do we review the security practices of important technology vendors?

PCC’s Microsoft 365 Security Checklist can help firm leadership begin reviewing identity, email, devices, file sharing, backups, monitoring, and employee preparedness.

How PCC Helps Bay Area Law Firms Strengthen Cybersecurity

Professional Computer Concepts helps Bay Area law firms manage technology and reduce avoidable cybersecurity risk.

Depending on the firm’s environment and needs, PCC can assist with:

• Managed IT support and proactive monitoring
• Microsoft 365 administration and security
• Endpoint protection and threat monitoring
• Email security and phishing protection
• Multi-factor authentication and Conditional Access
• Mobile device management
• Backup and recovery planning
• Security-awareness training
• Employee onboarding and offboarding
• Technology policies and documentation
• Vendor coordination
• Long-term technology and security planning

The right combination of protections depends on the firm’s size, systems, working practices, client requirements, and risk profile. Our role is to help identify practical priorities and manage the protections the firm chooses to implement.