Lock Down Airport and Other Trip Use
Travel can present several security challenges, including the possibility employees will log into publicly available Wi-Fi networks at airports, restaurants and other locations.
“There's always that temptation to use free Wi-Fi,” Ellis says. “There have been recent security alerts that hotel and other Wi-Fi [options] are under even more attack than they've been in the past; it's really better to either use your secured [cell] phone as a hotspot or travel with a separate device you connect to — essentially a personal router that can be properly procured.”
A personal router can connect to other Wi-Fi sources and create a private network; if firm members plan to log onto a hotel network, a software-based virtual private network (VPN) could offer further protection.
A lot of law firms — particularly small firms — don’t realize they are attack targets.
“Personal VPNs encrypt your data as it's traveling through the hotel Wi-Fi,” Ellis says. “Depending on what kind of data you're working with, you might want to add a personal VPN on top of [your phone hotspot].”
To determine when using external networks might be OK, law firms, Ellis says, should review how their state’s ethical rules define reasonable client data protection — and what security measures tech manufacturers have taken.
“It may be perfectly acceptable to use your [virtual VPN alone] in combination with a hotel Wi-Fi,” she says. “You're going to have to decide your tolerance for risk by looking at the terms of service of the tools you're using.”
The Law Offices of Daniel J. Siegel has a policy against logging into free Wi-Fi in public spaces. Hackers could use keylogger surveillance software, for instance, to track every key a person touches and learn what username and password is entered into various platforms, says attorney Daniel Siegel, a former ABA Law Practice Division chair who also runs a law firm tech consultancy, Integrated Technology Services, LLC.
Because passwords alone may not be enough protection, Siegel’s firm requires multifactor authentication to log onto its network remotely.
“In an airport, where people are in a hurry, they're concerned about all kinds of issues other than, ‘How secure is my Wi-Fi?’” he says. “[It’s] really an easy thing to steal their data.”
Tweak Your Tech Framework
After establishing the remote tech practices a firm wants employees to adhere to, regular training can help ensure they remember what they’re expected to do.
“Every firm should have written protocols about technology in general, whether [or not] they’re using firm equipment,” Siegel says. “Those should be required annually; cybersecurity training in general should be done continually.”
Having a strong tech infrastructure in place is a key part of successful remote access, according to Monica Washington Rothbaum, chief operating officer and senior attorney at personal injury firm J&Y Law.
When the firm redid its tech stack about a year ago, making sure its applications were secure and able to integrate was a focus.
“Depending on what kind of data you're working with, you might want to add a personal VPN on top of [your phone hotspot].”
“We use cloud-based platforms for many of our core functions, including case management, communications and litigation and case-related work,” Washington Rothbaum says. “We look for technology partners that maintain strong security controls, including SOC 2 Type II compliance or comparable security standards. The goal is to give our team flexibility without sacrificing the safeguards that should surround client data.”
The firm set up role-based access in its case management system; employees see different dashboards with different sets of tools, depending on their job responsibilities. An intake specialist, for example, would have access to fewer items than a supervisor in the firm’s contact center platform.
“We have tried to create an environment where an attorney traveling across the country can still communicate with the team, access a case, review information and respond to a client without a significant difference in service,” Washington Rothbaum says.
Make Physical Hardware Adjustments
Hardware safety — including employee phone, laptop and other device management — can be another security consideration.
Attachments are sold for laptops, Siegel says, that prevent screens from being read at certain angles; he has a device that shields what he’s typing unless someone is looking directly at the screen.
Reminding employees to keep devices on them at all times can help prevent laptops from being left unattended if someone gets up to go the bathroom in a coffeeshop or steps into a quieter area of a train to take a call.
“When you're thinking about remote [access], physical security is even more important,” Washington Rothbaum says. “In an office, you have badges and keys, and everybody's around; when you're traveling, you may not have that. If you leave [a device] in a trunk, back seat or coffee shop, you could potentially lose some information saved to your laptop [to] work offline.”
To protect devices from being hacked, adhering to the standard password best practices — including choosing complex phrases and keeping them hidden from view — remains critical, Siegel says.
“Those kinds of things enhance your security so much,” he says.
Be Ready to Act if Hardware is MIA
Firms should have a point person who can immediately collect reports of lost or stolen phones, laptops, USB drives and other devices, Ellis says.
“When you're traveling, the biggest problem tends to be Wi-Fi access; the other problem is the actual device,” she says. “Do you have the ability to wipe those things from a distance if they get stolen?”
Free apps can be installed to track and wipe phones and tablets, according to Ellis.
“There is software [to] track a laptop, but you have to find and install it, Ellis says. “I would encourage, if there is going to be client data on those devices, that you have tracking software, as well as the ability to wipe those.”
Although some employees at firms with a bring-your-own-device policy may balk at the idea of having software installed on their phones, if confidential data will be on the devices, there needs to be a way to remove information, Ellis says — or the employees may need to have a personal and a work phone.
“Do you have the ability to wipe [devices] from a distance if they get stolen?”
“If they're going to use their own laptop, Wi-Fi, phone at home, it may be necessary to send someone to their house to connect to their devices to make sure they're appropriately secure,” she says. “Or you have to have a policy that forbids them from using their own Wi-Fi [or] laptop.”
Firms should also define whether other people can use employees’ devices — such as a parent letting their child play games on their work phone or sharing their computer occasionally with their spouse.
“Those things have to be resolved,” Ellis says. “Because that's a violation of your employment obligations, and if you're a lawyer, [your] ethical obligation. You have to understand the weight of the responsibility that comes with the fact you're responsible for other people's private data."
