Cyber security for law firms

1. The baseline every firm gets

• Microsoft Defender for Endpoint P2 on every managed device.
• A 24/7 cybersecurity remediation SOC staffed by people, covering endpoints and identity, plus phishing simulation for your staff.
• Attack surface reduction rules to shut off common tricks used by malicious attachments and scripts.
• Conditional Access: multi-factor sign-in required for everyone, and older sign-in methods that skip it switched off.
• Independent Microsoft 365 backup held outside your tenant.
• Mapped to the ACSC Essential Eight, so you know where you stand.

2. Email security and payment-redirection fraud

Business email compromise is when a criminal takes over a mailbox, or imitates one, and uses it to send altered payment instructions. Property settlements and trust account payments attract this kind of fraud because the amounts are large and the timing is predictable.

Enforced MFA and blocked legacy sign-in make a stolen password far less useful. The security operations centre watches for suspicious sign-ins at any hour, and phishing simulation shows which staff need a refresher before a real attack arrives.

Procedure matters as much as software. A simple rule helps: any change to bank details is confirmed by phone, on a number already on file, never one taken from the email. Telling clients at the start of a matter that your bank details will not change by email helps too.

3. If something does happen

Under the Notifiable Data Breaches scheme in the Privacy Act 1988, organisations covered by the Act must notify affected people and the Office of the Australian Information Commissioner (OAIC) when a data breach is likely to cause serious harm. Deciding whether a breach is notifiable is your firm's call. Our part is to tell you quickly and plainly what the security logs show happened, so you can make that call with the facts.

4. Insurer questionnaires

Professional indemnity and cyber insurers now commonly ask about MFA, backups, patching and monitoring. Because the baseline is mapped to the Essential Eight, you can answer those questions with facts. We don't claim that any setup makes a firm meet a particular rule, and we won't help anyone overstate their position on a form.

5. After hours

Attacks don't keep office hours. Security alerts are triaged around the clock, including weekends, and a person looks at each one. Our engineers pick up anything that needs fixing.

For a step-by-step list you can work through with your partners, see the law firm IT and cyber checklist, or answer the legal practice IT risk self-assessment to see which areas to tackle first.