Data Privacy

The ongoing stay-at-home mandates have quickly made remote working a reality for many law firms. But initially, some smaller and midsized firms were caught flat-footed by the government orders.

"Smaller to midsize firms have had to respond and weren't prepared for this on scale," said Mark Sangster, vice president and industry security strategist at managed detection and response provider eSentire.

Over the past few months, midsized firms and boutiques had to readjust their cybersecurity practices and lean more on third-party tech experts to meet the new cybersecurity challenges of work spaces spread outside the office.

Many of these firms shifted from a central office model to a dispersed workforce by investing in VPNs and remote access technology and leveraging multifactor authentication, Sangster said.

He added that midsized firms also began investing in endpoint security, while many midsized and small firms began deploying administrative tactics to curve cyber risk, including addressing employees' Wi-Fi security.

"Now that we're working from home, we have internet routers that are consumer-grade, and they don't have the same price point and security [as the firm's internet connection]. It's far more easily exploited," he explained.

In response, small and midsized firms often tell employees and lawyers to change their routers' default password and set their Wi-Fi to private.

"This is where the firm and employee have to step up and beef up their technology with the tools they have. People aren't going to buy six-figure firewalls for their home, and most law firms won't [buy it for them] either. Perhaps you may do that for particular rainmakers, but not your entire employee base," Sangster said.

Law firms are learning how to adjust their cybersecurity tactics primarily from third parties, said Ken Jenkins, principal and founder of cybersecurity provider EmberSec.

"I haven't seen an uptick in more sophisticated software and products per se, but the advisory is definitely blowing up, helping them understand their threats as they have a remote workforce," he said.

Pennsylvania midsized firm McNees Wallace & Nurick, for instance, has brought in vendors to audit its security settings and it added more multifactor authentication protections, said  Stephen Sobotta, the firm's chief information officer.

McNees Wallace also encouraged greater cyber awareness by leveraging a vendor that sends phishing alerts and messages to test staffers and attorneys. "If we can increase our user awareness their increased awareness adds to our depth of security and that's as important as adding additional layers of software, if you can stop an incident at the user," Sobotta said.

Not all firms are hiring extra expertise, however. Some are instead leveraging available resources.

Nicole Gueron, founding partner of 11-lawyer Clarick Gueron Reisbaum, for example, said she and her lawyers participated in CLE remote arbitration and Zoom training to meet the demands of working remotely. Additionally, while she's previously used an on-demand IT provider, as the firm works remotely "we've leaned on him harder to advise us" on cybersecurity best practices, she said.

Gueron said she wasn't sure what new tech-based steps she would take if mandates and safety concerns kept her staff out of its New York City-based offices for six or more months.

"Right now we are not intending on spending more, but if we've learned one thing from this situation, it's thinking we know what to expect in the future can be dead wrong."