The COVID-19 pandemic has forced law firms into a new work paradigm, switching overnight to a remote workforce. Law firms, already an attractive target for cybercriminals, now face a workforce operating from informal home environments. As a result, law firms must address data security risks as they balance making data available for remote access.

Sheryl A. Falk, a co-leader of Winston & Strawn's global privacy and data security task force, answers some of the questions surrounding how a remote workforce can still protect client information. Her answers have been edited for clarity and brevity.

What actions can law firms take to protect confidential client data?  

Law firms should consider and adapt to new data security challenges presented by remote work.

• Ensure that all connections to the law firm's information systems are made via a secure connection through a VPN or virtual desktop, with appropriate access controls in place, such as two-factor authentication;
• Restrict employee access to data needed to do their specific job functions;
• Stay on top of patching to update the firm's anti-virus and malware prevention software;
• Provide a secure portal for employees to use to upload confidential or sensitive data; and
• Ensure that the company's email system has appropriate phishing detection.

What should law firms communicate to their employees about remote work expectations?

Law firms should arm employees with information to keep data safe. Redistribute any firm data security policies, such as bring your own device policy or written information security program. Counsel employees on remote working best practices:

• Avoid the use of company computers or devices for personal use;
• Ensure any personal computer used to work has up-to-date antivirus and malware protection;
• Avoid using public Wi-Fi as it is more susceptible to hacking;
• Avoid transferring any confidential or sensitive information via email; and
• Be vigilant for phishing emails, and be on guard for requests to enter credentials or make payments.

How should firms be prepared to respond to potential cybersecurity incidents?

Firms should stay alert for potential unauthorized access, including monitoring logs and external connections to the network systems to detect an unauthorized third party from penetrating the law firm's network. Firms should also ready their response to an incident by quickly reviewing their data security response plan and cyberinsurance. Communicate with the designated response team and outline responsibilities ahead of time. Ensure that employees have a number to call to notify the firm of a suspected data security incident.

While it is not possible to prevent every cyberattack, law firms that take action to secure their data will be best positioned to weather this virus crisis.

Sheryl A. Falk is a co-leader of Winston & Strawn's global privacy and data security task force. She concentrates her practice in data security, cyber and other internal investigations, trade secret litigation, and complex commercial litigation.