IT for law firms, confidentiality first

Law firms have a professional obligation to protect client confidences that exceeds what most businesses face, and increasingly that obligation is read to include competent technology practice. A firm that loses client data through a preventable failure has a problem considerably larger than downtime.

The practical technical picture is document management, email, calendaring with deadline consequences, and often a document-heavy file structure that has grown organically over many years with permissions nobody has audited.

Access control and privilege

The most common structural problem we find in firms is that almost everyone can reach almost everything. This is usually the residue of a small firm's early days rather than a decision, but it becomes a real exposure as the firm grows, and it makes ethical walls difficult to implement when a matter requires one.

We restructure permissions around matter and practice group, implement ethical walls where conflicts require them, and audit who can reach what so the answer is documented rather than assumed.

Email is the primary risk

Business email compromise is a serious and specific threat to firms because of trust account activity and wire instructions. An attacker with access to a partner's mailbox, or the ability to convincingly impersonate the domain, can cause substantial financial harm quickly. Correct mail authentication, enforced multi-factor authentication and staff training are not optional in this sector.

Deadlines change the calculus

A calendaring system failure in a firm carries consequences that a comparable failure elsewhere does not. Systems touching docketing and deadlines get priority in monitoring, in backup frequency, and in restoration order.