As legal technology becomes more commonplace across the industry, legal clients expect their attorneys and law firms to not only have modern resources, but robust measures in place to protect their information.
With cyber threats on the rise, it’s crucial that law firms take steps to protect their clients’ sensitive and confidential information. A cyber breach has the ability to negatively impact a firm in a number of ways, including being held “hostage” by ransomware, loss of income from business disruption, reputational damage, and other costs.
Overview of Cybersecurity for Law Firms
The threats to attorneys’ and law firms’ data are at an all-time high. According to ABA Formal Opinion 483, the data security threat is so high that law enforcement officials divide business entities into two categories: those that have been hacked and those that will be.
Law firms are included in this threat. While many solo attorneys and law firms are employing safeguards and prioritizing cybersecurity, some report that they are not using the basic measures recommended by security professionals — let alone any advanced protections or defenses.
In the 2021 Legal Technology Survey from the ABA, 25% of respondents overall reported that their law firms had experienced a data breach at some time.
Common Law Firm Data at Risk
Law firms amass a wealth of sensitive data about employees, clients, and prospective clients.
This may include:
- Banking and credit card information
- Social security numbers
- Driver’s license numbers
- Medical records
- Addresses
- Contact information
- Business or tax details
Rules and Regulations for Cybersecurity for Law Firms
Attorneys have ethical and common law duties to take competent and reasonable measures to safeguard information related to clients. There are also contractual and regulatory duties to protect confidential information.
In fact, the ABA has several ethics rules that apply to safeguarding information, including Model Rule 1.1, Model Rule 1.4, Model Rule 1.6, and Model Rules 5.1, 5.2, and 5.3. Together, these rules require attorneys to employ competent and reasonable measures to safeguard the confidentiality of client information, communicate about the use of technology, and obtain informed consent from clients when appropriate. It also falls on attorneys to supervise subordinate attorneys, staff, and service providers to ensure compliance.
Cybersecurity for Law Firms Best Practices
Law firms are in possession of so much sensitive and confidential information that could be disastrous in the wrong hands. Still, some law firms are unsure how to go about protecting themselves and limiting exposure.
Here are the best practices for cybersecurity for a law firm:
Routine Risk Assessments
Whether you have an in-house IT department or an outside vendor, you should conduct ongoing security risk assessments, penetration tests, system, and network monitoring, and vulnerability scans to protect against suspicious activity and breaches.
Manage Passwords
It’s crucial that all law firm staff members use strong passwords. This means a password of at least 12 to 14 characters that include letters (uppercase and lowercase), numbers, and symbols. Law firms should also implement multi-factor authentication where appropriate, especially if there’s access to data involved.
Implement a Backup Strategy
Business continuity tends to be an issue during a data breach. You should have a backup strategy to recover data following a breach to limit downtime. Routine data backups and offline storage ensure that it is immune to ransomware threats, and all backups should have encryption with a user-defined encryption key, no matter where they’re stored.
Provide Awareness Training
Provide security training and education for all staff — including attorneys — to teach them to detect, report, and defend against threats to the firm or client’s sensitive, confidential information. Cybersecurity awareness training should be provided at least once a year to include emerging cyber threats and reinforce best practices.
Evaluate Third-Party Vendors
Third-party vendors are a significant security threat to any organization, law firms included. It’s important to vet any vendor who works with the firm to ensure they have the same robust security measures in place, including periodic onsite security assessments.
Use Encryption for Transmitting Sensitive Data
Encryption makes information unreadable to anyone who doesn’t possess the “key” that changes the information back to its readable form. Encrypting sensitive data with identifiable information, such as health records, is important to keep it protected during transmission. In fact, ABA Formal Opinion 477R requires confidential data to be sent via encrypted email.
Use Cloud-Based Practice Management Software
Law firms may be concerned about security with cloud-based solutions, but they’re more secure and cost-effective than on-premise solutions. Cloud-based law practice management solutions, such as PracticePanther, provide automatic updates, security, and support. PracticePanther comes with ABA and IOLTA-compliant features and 256-bit military-grade encryption to ensure confidential data is safeguarded. There’s also an option to limit access for staff members with custom roles.
What Is Cybersecurity Insurance?
Cybersecurity insurance is a type of business insurance that provides financial coverage to help law firms and solo lawyers recover from data breaches, ransomware, or other malicious attacks that can result in financial or reputational damage.
There are two types of cybersecurity insurance coverage that apply to law firms:
- First-party cyber liability insurance provides coverage for the direct financial impact of a breach or cyber attack in the network or system. This may include income lost in downtime, the fees for restoring data, forensic investigations, and more.
- Third-party cyber liability insurance protects law firms from liability claims in the event of a breach. This may include payments to clients or regulatory fines for noncompliance.
Law firms can carry one or both types of coverage, depending on their circumstances and risk. Cybersecurity insurance doesn’t provide coverage for physical property damage or the loss of intellectual property, however.
Does My Law Firm Need Cybersecurity Insurance?
Any business that stores sensitive client or business information online should have cybersecurity insurance, including law firms. Cybercriminals understand that law firms amass valuable information, making them an attractive target.
What to Look for in Cybersecurity Insurance for Law Firms
Like all insurance, cybersecurity insurance providers may offer different coverage at different premiums. It’s important to understand what you need for your law firm and choose the right provider to get the peace of mind you need at the right price.
Here are some questions to consider:
How much cybersecurity risk are you exposed to? The bigger the potential risk, which is high for law firms, the more you should consider paying a premium price to work with a top-tier provider. If a breach occurs, you don’t want to have to fight with the insurance company to get your payouts.
How flexible are cybersecurity liability policies? Insurance providers package policies differently, and cybersecurity insurance is no different. It’s up to your law firm to determine the level of protection you need and what policies are a good fit based on the available options, payout limits, and terms.
How does the insurance provider manage cybersecurity threats for first-person vs. third-person coverage and in-house vs. cloud-controlled data and applications? Insurance companies use different methods to evaluate risk. Some providers may place a higher risk on internal or external cybersecurity threats. The popularity of cybersecurity insurance is growing, as well as the amount of cybersecurity insurance providers to choose from. This offers a competitive advantage in finding a strong provider with reasonable premiums.
Make sure you shop around and get different quotes before making a decision. Evaluate all your coverage options, premiums, and the providers themselves to make your decision.
Protect Your Law Firm’s Sensitive Data
Protecting your law firm’s data starts with the precautions and cybersecurity practices you have in place. Law firms need protection like any other business, especially with the wealth of confidential information at stake. Having a robust cybersecurity protocol, and cyber liability insurance is crucial for your firm’s continued success.
