As assistant general counsel at Microsoft, at his previous jobs at Accenture and IBM, and on social media where he's a consistent commentator on tech issues, Dennis Garcia has staked his claim as being on the forefront of emerging issues. And especially in today's data-rich environment, there are few issues as core to a technology company's business as cybersecurity and privacy.

Taking a cue from “A Tale of Two Cities,” Garcia said, “It was the best of times, it was the worst of times. When I think about the technology space right now, especially in the data-driven world, I think that's an accurate summation.”

So does one keep a company in the best of times rather than the worst when it comes to security? At the Monday morning keynote of the Association of Legal Technologists' second ctrl ALT del conference, Garcia ran down 20 factors that attorneys and legal technologists should always consider when it comes to security and privacy. If that seems like a lot, Garcia noted that it's crucial to furthering an attorney's primary value proposition: trust.

“What I think it really all comes down to at the end of the day is this notion of trust,” Garcia said. “What it means for your organizations … think about how you also build that trust in terms of your clients' data.”

Garcia's 20 Tips

1. Set the tone at the top: “You need to make sure your senior leaders have bought in on protecting client data.”

2. Knowing when to ask for help: “It's a growing area, but it's a highly specialized area, so you need to make sure you get the right folks.”

3. Conduct security audits: “It's always great to get a third party perspective.”

4. Get a better handle on what data you have: “Some quite frankly don't do a good enough job understanding the landscape of their data.”

5. Put written information security policies (WISPs) in place: “There's been a tendency to cut and paste a policy from another company. … But you need to be careful with that. Every organization is different with their scale and their size.”

6. Watch for employee separation and disgruntled employees: “You want to give some thought as to … what sort of access to information should he or she have.”

7. Training, training and more training: “Think about how you deliver meaningful training to your employees … When you do this training, make sure you keep it current.”

8. Institute Transparency: “Think about you can be very clear to your clients and customers to the steps you're taking. … I think we'd rather work with a technology provider that overcommunicates what they're doing in this space than undercommunicates.”

9. Consider password management: “People have a tendency to use the same password over and over and over again.”

10. Institute multifactor authentication: “A lot of cybersecurity specialists and experts say that having multifactor authentication goes a long way towards deterring the cyber criminals.”

11. Watch out for phishing: “Be careful of what you're seeing in your emails, be careful clicking on attachments. … We've been seeing more and more phishing attempts against senior executives in a company.”

12. Download security updates: “One way to protect you against that is making sure you're using the most up-to-date security solutions.”

13. Use hyperscale cloud providers: “We're all using leading and best-in-class security policies and protocols. … There's no way law firms can match that in scale. … There's no doubt we can do a much better job protecting their own data or their clients' data than what they could do.”

14. Conduct thoughtful evaluation of technology providers: Bring in a number of different stakeholders “to really vet and ask questions of these providers, and get that level of detail.”

15. Be social and secure: “We're seeing social media is becoming an increasing vector for cyber criminals.”

16. Be cyber aware in public: “You want to make sure you're always logging into your company's virtual private network … so data is exchanged only over your own network.”

17. Create an incident response plan: “It's only a matter of time. … You want to have a game plan in place in case you are hacked and there's a data loss issue.”

18. Look into cyber insurance: “If you're thinking about acquiring cyber insurance, make sure you really understand the scope of that agreement.”

19. Email = front page of the newspaper: “I think about email being more like a postcard than a sealed envelope.”

20. Learn from others: Citing among others IAPP, the RSA, the FTC and the Ponemon Institute, “This whole area of privacy and cybersecurity is constantly evolving and changing, so you want to do your best to make sure you're keeping up to speed.”