Allowing remote computer and network access in law firms allows lawyers to work outside the office and grants IT access to remotely fix everything from a minor administrative issue to a cyberattack. However, it may not be all benefit. After all, utilizing manage service providers (MSP) for remote monitoring and management (RMM) can be a backdoor for cyberattackers, many of whom have their sights on law firms.

While remote administrative tools help productivity, they still represent the most risk for law firms, said Mark Sangster, vice president and industry security strategist of eSentire Inc.

Indeed, ransomware recovery firm Coveware reported in Q4 2019 that one strain of ransomware called Sodinokibi has a "deep specialization" in compromising and exploiting RMM tools used by managed service providers in small and large enterprises.

Despite the growing threat, many law firms are operating under the assumption that phishing attacks are still their top security concerns, Sangster noted.

"Most firms are laboring [under the idea] that a lot of attacks and ransomware comes through phishing, which is true but the phishing, if its involved, is step one, [and] at some point they are going to pivot to those remote monitoring tools." He added, "I think the assumption is because it's under administrative control, it's safe."

To be sure, cybersecurity experts say bad actors are targeting their remote access abilities not only to elicit ransoms, but to also exploit law firms' sensitive client data.

"The information they hold is so valuable," said Michael Hamilton, co-founder of cybersecurity solution company CI Security, of law firms. "They know about mergers and acquisitions, intellectual property and upcoming financial transactions. The valuable stuff isn't the ability to extort them but to monetize the information they can steal."

Still, law firms can take certain steps to ensure their MSPs aren't a backdoor to their data.

Cybersecurity experts contacted by Legaltech News agreed strong authentication is crucial for a MSP to confirm any activities on its network are legitimate. They also recommended ongoing cybersecurity audits and testing to properly manage their risks.

Along with thoroughly vetting a MSP, law firms could decrease the amount of "live connections" a MSP has to a client, said Gary Salman, CEO of cybersecurity provider Black Talon Security. Instead of being able to instantly access a computer, an employee would send a request through a web portal, he explained.

It's an "old-school approach," Salman said, which may increase response time but may prevent unintended intruders from having instant access to a firm's network.

Still, as the threats targeting legal grow, cybersecurity professionals say law firms are unlikely to drop their MSP or remote monitoring features.

"I think the economics of outsourcing that are pretty compelling, especially if you are a five-person shop. You aren't going to hire an IT person or security team," Hamilton said.

Larger law firms with multiple offices must also weigh the benefits of having IT access various offices remotely against the risk of criminals exploiting that convenience, eSentire's Sangster said.

"You are put in between a rock and a hard place. They [hackers] know you have to use it and you have to have it, and that's why they are going after it."