Proper education can help in preventing any of the cybersecurity attacks described in the 411 on Cybersecurity and Your Firm. While it is true that your IT department plays a vital role in ensuring your firm follows cybersecurity best practices, that does not mean they alone are responsible for your firm’s security. Awareness of and participation in cybersecurity best practices need to become part of your firm’s culture for every single person. Here are three things you can do.

Limit Employee Access to Data and Information

Limiting the amount of data employees have access to helps reduce the chance for human error. Employees should only have access to information that pertains to their role. If an employee leaves the company, transfers to another location, or takes a new role within the firm, take the necessary actions immediately to secure firm data. You should take back the employee’s badge and keys, delete old passwords, and remove them from any accounts they had access to.

Educate Employees

When a firm takes the time to educate their employees, they become aware of potential cyberattacks and can become your last line of defense. Your firm should provide frequent educational opportunities on cybersecurity awareness and best practices. Topics you can explore might be:

• The risks of using personal email in the workplace
• How to recognize a potential cybersecurity attack
• What to do if you receive a suspicious email
• Best practices in managing passwords

Educate every employee to protect valuable data. A good practice is creating an information security policy that outlines how information technology (IT) assets and resources should be used, managed, and protected. These rules must be applied to everyone in your firm, without exception, because exceptions leave holes in your security.

Use ongoing training to reinforce the culture of education and awareness. Training exercises are a great way to educate your employees in a controlled setting. An example of a training exercise can be a fake phishing email sent to all employees to track who performs what actions. If an employee takes the incorrect actions, it gives you the opportunity to provide further training immediately.

Strong Passwords and Multi-Factor Authentication

Strong, complex passwords are your first line of defense against a cybercriminal, preventing them from gaining access to you or your employees’ accounts and stealing sensitive information and data. Ideally, passwords should be a unique combination of upper and lowercase letters, numbers, and symbols. Many people rely on easy-to-remember passwords or use the same password for multiple accounts. Weak passwords usually are the result of users choosing convenience over security. Using a password manager is a safe way to automate the creation, storage, and security of passwords.

Multi-factor authentication (MFA) can add an additional layer of defense and is available on most applications and websites. When MFA is enabled, users need to provide two different authentication factors to sign into an account. These factors include combinations of:

• Knowledge, aka something you know, such as a password or security question
• Possession, aka something you have, such as an SMS code or physical key
• Inherence, aka something you are, such as a fingerprint or face ID

With MFA enabled, even if a cybercriminal gains access to your passwords, they would still need to provide additional credentials to gain access.

Understanding your responsibilities and implementing best practices can help mitigate potential cybersecurity attacks for your law firm and your clients. By mitigating these potential attacks, you can spend more time focusing on practicing law and managing your firm.