For law firms, cybersecurity is just one item on a long to-do list, but it is not an issue that can be ignored.
According to a recent American Bar Association (ABA) report, 29% of law firms experienced a data breach in 2023. Because they handle sensitive client information, law firms are a ripe target for threat actors, and cyber threats are only growing. Hackers now utilize automation and AI to create more convincing phishing and deepfake attacks.
Sticking your head in the sand is not an option. ABA ruled that lawyers are ethically obligated to “prevent unauthorized access or disclosure of client information.” Compliance laws are continually updated to address how legal firms and other entities handle sensitive data. Compliance rules can be stringent depending on your location and the industry you work in. Regulators issue steep fines and dole out other consequences for falling out of compliance.
Law firms that suffer breaches can face severe consequences. For example, one firm was forced to settle a class action suit against it for $8 million after a cyber-attack exposed over 600,000 users' personal information.
So, how can lawyers with limited time and resources address cybersecurity for their law firms?
We recommend working with cybersecurity technology experts. However, a firm should proactively pursue several action items in conjunction with or independently of working with a cybersecurity firm. The actions discussed in this article will help your firm get a leg up on cybersecurity and better defend your client data.
Creating a written cybersecurity policy is not a one-time project. Instead, it should become a living document, frequently reviewed and updated regularly. Your cybersecurity policy should include the following points:
The rest of this post will cover categories you may want to mention in the cybersecurity plan for your law firm.
Creating a cybersecurity plan is a never-ending project, like cleaning the garage. However, a great first step is to document the current state of your cybersecurity efforts. This text details the current security tools, practices, and protocols in place, as well as areas to address moving forward.
Working with a vetted third-party security firm is recommended at this phase, as cybersecurity professionals can access in-depth scanning tools to pinpoint technical weaknesses you were unaware of. As a bonus, many cyber liability providers require a vulnerability scan as a part of their application process.
The audit will likely point out some areas where you are lacking. Some of the following may come up as areas to focus on, but regardless, improving your cybersecurity hygiene is never a bad idea.
Multiple sources, including Stanford University, have found that over 88% of data breaches are caused by human error. It is not enough to simply include phishing training for new employees once. Cybersecurity training must go beyond onboarding. ABA recommends firm-wide cybersecurity training at least once a year (ideally once a quarter).
Also, it pays to get ahead of employees regarding using generative AI in training materials and AUP documentation. If not addressed, lawyers might seek shortcuts offered by AI without considering the unintended risks of AI hallucinations or exposing sensitive data to a public GPT.
Also read: Responsibly Adopting AI in Law Firms
In today's growing cyber threat landscape, law firms must prioritize cybersecurity to protect sensitive client information. To fortify your defenses, regularly update your policies, conduct audits, and invest in employee training. Do not wai`t for a breach—take proactive steps today to secure your firm’s future. Act now to protect your practice.
Protexure can help your firm make sense of cybersecurity for your law firm and select the liability policy that works with the current landscape. Get in touch to learn more.