Cyber security checklist for law firms

By Jonathan Ashley, co-founder of etiCloud. (15 January 2024)

1. Achieve Cyber Essentials accreditation from the National Cyber Security Centre. It’s an accessible first line of defence and a great place to start if your security is lacking.
2. Take a detailed look at where data enters and leaves your firm and put cyber security solutions in place in these areas (see 4-9, below). This enables more accurate detection in a cyber attack situation, to work out which systems must remain closed down.
3. Analyse whether you can separate data and systems, to limit the impact of any breach. There are risks and benefits to integrated systems, so understand the implications.
4. Use anti-malware software to protect your IT systems and devices against cyber attacks intended to harm or exploit them. It provides a basic level of cyber protection.
5. Implement Multi-Factor Authentication (MFA) for every single user. (See Multifactor Authentication is a critical layer of cyber security.)
6. Add Inline Email Security to your cyber security toolkit. This application blocks malicious emails or files before they enter a user’s mailbox, scanning every email and providing a high level of protection for every user.
7. Use a different password for every different website you use and ideally change the passwords on a monthly basis.
8. Consider Web Filtering. This technology prevents users from accessing certain websites or URLs and prevents the user’s browser loading any pages from such sites.
9. If your software is not already hosted in the cloud, seriously consider it. A large element of your firm’s cyber security can be handled by the managed service provider — to whatever standard your budget allows.
10. But be cautious when procuring and using third-party software and services, as these too can be the entry point for a cyber attack.
11. Keep up-to-date with what latest technology is available and its cost-benefit, usually in liaison with your managed service provider.
12. Document all your systems and suppliers, so full information is readily available and you know who to contact in an emergency.
13. Diarise regular security reviews and tests and stick to them. It only takes one late patch or software update to potentially allow an attacker to enter your system.
14. Invest in regular cyber security training, as employees are usually the number one point of vulnerability. Familiarise them with your firm’s security protocols and data protection policies.
15. Include that training in the induction process for every new employee.
16. Regularly test that training, or people will relax their guard. For example, see if anyone (including senior management) replies to dummy phishing emails.
17. Consider holding ‘insight sessions’, to learn from the experiences of others. For example, the well documented Allen & Overy attack this year: how would your team respond?
18. Consider cyber insurance, as professional indemnity insurance is not designed to cover cyber attacks (although it can provide cover in particular situations).
19. Draft and agree a breach response plan to ensure you are fully prepared to deal with the aftermath of cyber security attack.
20. The response plan must include reporting any breaches of personal data to the relevant regulators and any individual directly affected.
21. You can outsource your firm’s cyber security, but your senior management team still has responsibility for it: responsibility for the return on investment and for the level of risk your firm is accepting by not investing more time and money into cyber security.

See also:

• Cyber security for law firms FAQs
• Anatomy of a law firm cyber attack
• Webinar recording: Risk protection including cyber security (February 2023)
• NSC Cyber Threat Report: UK Legal Sector (June 2023, 24 pages)