Modernizing Your Firm with a Security-First Approach
The key to protecting client information is knowing what security features to look for in a collaboration tool so that your firm can modernize safely.
September 17, 2019 at 07:00 AM
5 minute read
The legal industry is no longer getting away with outdated collaboration tools and processes. Clients are moving toward modern cloud-based solutions like Microsoft Office 365 suite and Microsoft Teams, and they expect their legal support to follow suit.
To be fair, the industry has good reason to drag its feet. Sensitive information is their product and safeguarding it in the right way directly links to a firm's ability to generate revenue. Law firms must be able to keep a secret, and with attorney-client privilege always a major consideration, law firms are justifiably extremely concerned with security. With cloud software breaches regularly in the news, it's reasonable to worry that introducing modern collaboration tools could put client information—and firms' reputations—at risk. Even more, privacy regulations like GDPR and the forthcoming CCPA subject some client information to additional legal protections beyond attorney-client privilege.
As a result, few firms have moved to the cloud, and most continue to use antiquated, on-premise solutions to collaborate and create documents. However, modernizing collaboration processes is critical if firms wish to survive. Clients expect automation and efficiency—endless back-and-forth email correspondence and an unlimited number of billable hours will get late adopters killed by the competition.
Protecting client information is just as critical as keeping up with the competition, but firms must find a balance. The key is knowing what security features to look for in a collaboration tool so that your firm can modernize safely.
|What to Look for When Choosing a Collaboration Tool
A security-first mindset requires understanding exactly what makes secure collaboration tools secure. Luckily, from a conceptual standpoint, cloud-based solutions are not too different from their on-premise predecessors: You want to make sure the software "container" that holds your data is secure, the transfer of data is protected and only users who have permission to make changes to your documents are doing so. The cost of having the right security measures can be high, but the cost in loss of reputation may be even higher.
In addition to a secure container, let's not forget the end user is in many cases the source of a breach. A workflow-based collaboration tool with strong processes for governing authenticated collaboration will make it easier to ensure security for end users. But as always when it comes to security, awareness and training are just as important as the tool.
Let's take a deeper dive into what all that means:
First, firms need to be clear about where and how a vendor stores sensitive information in the collaboration tool. Before moving forward, ask your vendor the following questions: Is information bouncing between servers? Where is it saved? Which employees of the vendor have access to the information and for how long? Are we keeping track of the content's access history?
To answer some of these questions, firms can check the vendor's compliance with various standards and certifications. The vendor should be able to provide thorough details on how they live up to International Organization for Standardization (ISO) 27001, focusing especially on the hosting environment and the software development lifecycle. If a firm meets these requirements, then you know that their security controls are strong, and the way in which they protect and authenticate access to your documents is up to modern standards.
It's also smart to evaluate the tool's version control settings. When users collaborate and make edits on a document, it's not only important that formatting remains consistent, but that everyone can track who made which changes. As a standard, cloud-based offerings have strict version control. But before moving forward, confirm what privileges the tool grants users and if the versioning controls are ISO certified.
Once a solution is deployed, it's not enough to assess once whether the tool is delivering on its features — and perhaps more importantly, if its security promises check out. It's imperative to continuously monitor vendors with a risk-based approach upon selection, onboarding and throughout the lifetime of the vendor until offboarding. This ensures that security requirements are met from the outset and are constantly updated to comply with the evolving security landscape, while continually monitoring for security risks to avoid data leaks or breaches.
Implementing state-of-the-art collaboration tools that deliver a seamless client experience is just one aspect of modernizing the legal industry's workflows. Other essential technologies, like document automation software and digital compliance tools, must also be robust enough and thoroughly vetted to make sure they uphold the industry's privacy and security requirements.
With this advice in mind, firms can confidently modernize their workflows and deliver better client experiences—without putting sensitive information at risk. The key aspects to consider are compliance to certifications and standards with a continuing risk-based vendor management approach to exceed clients' security and privacy expectations. Law firm clients are embracing collaboration and document automation tools and getting more efficient—and they expect the same from the law firms that represent them.
Jean-Marc Chanoine is a strategic account manager and legal consultant at Templafy. He previously worked for the Navy and Accenture Strategy.
Ellen Benaim is the information security officer at Templafy. Prior to that, she worked at Apple and Hudson Advisors.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllHow Legal Tech Providers Can Walk the Walk on AI, Not Just Talk the Talk
5 minute readDemystifying Data-First Contracting: Transforming Contracting Into a Value Creation Asset
6 minute readTrending Stories
Who Got The Work
Clark Hill members Vincent Roskovensky and Kevin B. Watson have entered appearances for Architectural Steel and Associated Products in a pending environmental lawsuit. The complaint, filed Aug. 27 in Pennsylvania Eastern District Court by Brodsky & Smith on behalf of Hung Trinh, accuses the defendant of discharging polluted stormwater from its steel facility without a permit in violation of the Clean Water Act. The case, assigned to U.S. District Judge Gerald J. Pappert, is 2:24-cv-04490, Trinh v. Architectural Steel And Associated Products, Inc.
Who Got The Work
Michael R. Yellin of Cole Schotz has entered an appearance for S2 d/b/a the Shoe Surgeon, Dominic Chambrone a/k/a Dominic Ciambrone and other defendants in a pending trademark infringement lawsuit. The case, filed July 15 in New York Southern District Court by DLA Piper on behalf of Nike, seeks to enjoin Ciambrone and the other defendants in their attempts to build an 'entire multifaceted' retail empire through their unauthorized use of Nike’s trademark rights. The case, assigned to U.S. District Judge Naomi Reice Buchwald, is 1:24-cv-05307, Nike Inc. v. S2, Inc. et al.
Who Got The Work
Sullivan & Cromwell partner Adam S. Paris has entered an appearance for Orthofix Medical in a pending securities class action arising from a proposed acquisition of SeaSpine by Orthofix. The suit, filed Sept. 6 in California Southern District Court, by Girard Sharp and the Hall Firm, contends that the offering materials and related oral communications contained untrue statements of material fact. According to the complaint, the defendants made a series of misrepresentations about Orthofix’s disclosure controls and internal controls over financial reporting and ethical compliance. The case, assigned to U.S. District Judge Linda Lopez, is 3:24-cv-01593, O'Hara v. Orthofix Medical Inc. et al.
Who Got The Work
Attorneys from Cadwalader, Wickersham & Taft and Pryor Cashman have entered appearances for Diageo Americas Supply d/b/a Ciroc Distilling Co. and Sony Songs, a division of Sony Music Publishing, respectively, in a pending lawsuit. The case was filed Sept. 10 in New York Southern District Court by the Bloom Firm and IP Legal Studio on behalf of Dawn Angelique Richard. The plaintiff, who performed as a member of producer Sean 'Diddy' Combs girl group Danity Kane and later his band, Diddy - Dirty Money, claims that she was financially exploited by Combs and subjected to inhumane working conditions. Among other violations, Richard claims that Combs required group members to remain at his residences and studios, deprived them of adequate food and sleep and forced them to rehearse for 36 to 48 hours without breaks. The case, assigned to U.S. District Judge Katherine Polk Failla, is 1:24-cv-06848, Richard v. Combs et al.
Who Got The Work
Mathilda McGee-Tubb and Kevin M. McGinty of Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, as well as Jesse W. Belcher-Timme of Doherty, Wallace, Pillsbury & Murphy, have stepped in to defend Peter Pan Bus Lines in a pending consumer class action. The suit, filed Sept. 4 in Massachusetts District Court by Hackett Feinberg PC and KalielGold PLLC, accuses the defendant of charging undisclosed 'junk fees' on top of ticket prices during checkout. The case, assigned to U.S. District Judge Mark G. Mastroianni, is 3:24-cv-12277, Mulani et al v. Peter Pan Bus Lines, Inc.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250