The unexpected shift to a remote workforce accelerated the pace of digital transformation. Having to vet an onslaught of new technology quickly, firms added different applications, communication and collaboration platforms, and cloud-based document management and storage systems to their tech stack. However, adding these disparate technologies and integrating them creates an entirely new set of opportunities for cyberattacks and associated data security compliance issues. Fortunately, you can quickly address these law firm risk management and compliance challenges by moving to an end-to-end legal practice management system.
Risk and compliance issues facing the modern law firm
Above The Law recently surveyed firms about their use of technology. The survey highlighted substantial tension around law firm risk management issues, such as data security, during technology adoption.
Law firms have always been attractive targets for cybercriminals because of the high-value corporate information in their possession. Unfortunately, they have also traditionally been soft targets. Recent years have seen numerous high-profile cyber attacks on law firms, including a ransomware attack on Chicago’s Seyfarth Shaw.
As firm networks expanded substantially with additional services and applications to accommodate an increasingly remote workforce, the potential for exploits also increased drastically. These elevated attack efforts highlighted the risk management concerns with firm data storage, whether in in-house corporate networks or externally hosted private cloud services.
Given the amount and sensitivity of data in today’s firms, corporate network breaches pose a significant risk for firms. Breaches can expose data subject to any number of data privacy and protection laws and regulations worldwide (e.g., HIPAA, GDPR, CCPA, CPRA, etc.), subjecting firms to costly notification and remediation efforts, reputational damage, and even potential civil and criminal liability.
Risk and compliance issues for law firms can be vastly more complicated than for other companies. In addition to various legal and compliance requirements, lawyers and their firms have specifically defined ethical obligations to take appropriate technological steps to protect their clients’ information. Firms also frequently must consider how litigation issues such as protective orders impact their responsibilities.
Law firm technology: compliance solution or added risk?
With all of a firm’s various data protection obligations in mind, the natural question is whether new legal technology assists firms with risk management or simply presents another attack vector for the determined cybercriminal. According to the Above The Law survey, the answer is both.
The survey, which included responses from firms representing every size category, indicated that data security was both a goal and a concern for new legal technology adoption, particularly when it comes to cloud-based services. Indeed, while a significant majority of the responding firms believed that data security was a benefit they could achieve by transitioning to the cloud, they still have strong concerns about whether that added data security was sufficient.
Firms are also seeking more effective and secure ways to manage documents, from secure storage to online collaboration tools. According to the survey, this was a common purchase driver for firms of all sizes. Because document storage and processing tools raise several data security and data privacy issues, firms need reliable, secure systems that provide high-level security while also allowing firms to work more efficiently with their clients.
Solving compliance issues with integrated practice management solutions
Integrated legal practice management (PM) platforms offer firms several advantages for data security risk management. One of the most important advantages is that the connections between various functions (for example, document management and client communications) are tightly interwoven into the PM solution, as opposed to ad hoc systems where firms have to use third-party APIs or build their own to make their various applications talk to each other.
In systems where every function uses a different application, every API connection is a potential attack point. Moreover, each application typically has its own set of passwords, creating yet another avenue of access for dedicated hackers. Also, it is well-documented that poor password hygiene is one of the easiest ways for attackers to gain access to corporate networks. The danger is further complicated by the fact that each application has its own associated data storage area.
Despite the clear security superiority of the integrated PM solution, firms have yet to take advantage of these systems to improve regulatory compliance. Indeed, according to the survey, less than 10% of firms use an integrated PM solution. The remaining 90% of firms split almost evenly between those using a wide range of minimally integrated, single-purpose applications and those using a PM platform in conjunction with other applications.
The problem only intensifies when firms try to make independent applications work together. Then, the connections between applications and data sources become new avenues of exploitation for attackers.
Finding the most secure PM platform
Fully integrated practice management solutions have much more limited attack surfaces compared to the ad hoc approach. Individual features (e.g., CRM, accounting, document creation and collaboration) are all part of a single platform, using a shared data source. There is no need to build exploitable connections between applications and services.
When looking for an integrated practice management solution, review the provider’s security policies and certifications. You must be able to rely on your provider to protect both your data and your business continuity in the event of an attack or a breach. Look for whether they offer such features as:
- Data encryption at rest
- Identity and access management tools
- Strong password policies with multi-factor authentication
- Advanced security measures
While firms can and should rely on their PM solutions for security, they must realize that they can never fully delegate their data security obligations to outside providers. Most cloud service providers operate under a shared responsibility paradigm. The degree of the client’s responsibility depends on how much they have moved to the outside provider. Even beyond shared responsibility, however, firms have ethical obligations that do not apply to their providers.
That being said, secure integrated PM platforms help firms meet their obligations by setting policies that minimize the attack surface for their network. For example, you may wish to apply least access policies. Under least access principles, every firm member should only have access to the data and services necessary to complete their job. Any additional access should require added permissions.
Well-built PM solutions also allow you to define and apply relevant document retention and destruction policies. One of the best ways to ensure that a hacker does not access data is to destroy it before they can try. Therefore, all firms should rigorously define, apply and enforce document retention and destruction policies. PM platforms can simplify the entire process, thus limiting the amount of data available to hackers.
Simpler, better risk management and compliance solutions
An integrated practice management platform can be one of a firm’s best friends in simplifying its risk management and compliance efforts. Consolidating data sources, limiting the use of strained connections between functions, and minimizing the number of users’ accounts and passwords substantially reduces the number of potential vulnerabilities that a cybercriminal can try to exploit. So not only can you provide your clients with a highly functional, easy-to-use way to collaborate with you, you can give both them and you the peace of mind that their data is as safe as it can be.
