In this instructional video, Sarah Prevost outlines why law firms are high‑value targets for cybercriminals and details practical, ongoing security measures to safeguard bookkeeping, financial, and client data. She first explains the major threats—AI‑enhanced phishing, ransomware, and insider risks—then walks through a comprehensive set of best practices: enforcing least‑privilege access controls in accounting software, using secure off‑site backups that are independent of native providers, encrypting data in transit, deploying multi‑factor authentication with authenticator apps, managing complex, regularly‑rotated passwords via password‑manager solutions, and cultivating a culture of continuous employee training and suspicious‑activity reporting (leveraging services like Wiser). Additional recommendations include endpoint protection, VPNs and firewalls for remote staff, data‑loss‑prevention tools, regular professional security assessments, and routine backup testing. The presenter emphasizes that cybersecurity is an ongoing process, not a one‑time project, and encourages firms to invest in expert services to avoid costly breaches.
Chapters
So this month we're going to talk about cybersecurity. It's such an important topic, and it's really all about protecting your financial data for a law firm, but also your clients' data. So law firms really do hold extremely sensitive information. They hold the client financial records a lot of times. They hold the trust accounts, the billing data, and confidential case files. Cybercriminals know this, which is why law firms are increasingly targeted. One single breach can destroy your clients' trust, cost hundreds of thousands in fines and recovery, damage your reputation for years. So in this video, we're going to learn some practical cybersecurity strategies Specifically protecting the bookkeeping and financial data. Let's make your firm more secure. So what are the major threats facing law firms? There's so many. We actually use a product in our firm called Wiser, and it's W-I-Z-E-R. And once a month they send out what's the most up-to-date cyber thing that's happening out there, or hack or whatever, what people are facing or experiencing. So what do we see? Phishing attacks and phishing being P-H-I-S-H-I-N-G, sophisticated emails that really look real with AI now. It's really hard to spot these. Like years ago, you could see them really simply. You could tell by the way the grammar was, but not anymore. They can trick your staff into giving away any of your credentials. So you want to make sure that there's a policy in place where you're training your staff to look out for these things. One of the worst things we see, and we've had this happen to a couple of our clients, is ransomware. Malware gets into the system, locks it down, locks your files. They demand payments, usually in cryptocurrency, and it can potentially expose your clients' data. And there can be insider threats too, risks from employees or contractors who accidentally or even intentionally compromise your data. These threats can halt your operations and lead to some serious legal consequences. So what are the best practices for protecting the bookkeeping data? And here's what actually works. So number one thing is strong access controls. Only give staff access to the financial data that they need to do their job. So you really have to make sure that their user access restricts them from seeing everything. You don't want the admin in the office to know the payroll of everybody, right? And with QuickBooks and with Xero, you can streamline that access so they only get what they need to see. You want to make sure you're backing up your data. Now with online, it's hard to do, but there are some programs out there that will back up your data and make sure that's done on a secure offsite location. So you don't want to be backing up your QuickBooks with QuickBooks because if they get compromised, the whole house of cards will go down. There's products out there that will do it. You can just search for that and you'll see that there are some things out there. Anytime you're doing any work, you want to make sure there's a good encryption in place. So encrypt sensitive data when you're moving information across the lines with email, right? You want to have a secure way of emailing your client where they're able to communicate with you and maybe share data, but it's not out there just in a plain simple email where anybody could hack it and take it. You want MFA, so multi-factor authentication. You want that on all your products, everything you use. Add that second layer of security everywhere possible. And I'm told by our cyber team that they don't want us really texting our phone. They want us to use the Google Authenticator or the Microsoft one. So that way you've got that in place. And then passwords should be protected in a password protecting system. And you need to train your staff and you need to have a good culture around this. So you need them to be curious when something comes in that they're very careful that they don't end up exposing you inadvertently. So enforce complex passwords. Nobody should have password123 anymore. And make sure that they're requiring the changes. I know it's a pain in the neck, but every 60, 90 days it should be done. And never reuse passwords across accounts. So you shouldn't have one password that you use everywhere. Regular employee training should be done, like we do, to help them understand some of the phishing things that are out there. Because a lot of times you don't realize the things that are happening. You get into a good system like, like the one we have with Wiser. It does help with that. And make sure that they're trained to know what to look for. Sometimes emails can come that came from either me or Sarah, and it's really not us. And anytime that happens to either one of us or any of our staff, we make sure that our cyber team gets into it and make sure that they stop that problem. So create a culture where everybody reports suspicious activity without fear. They check in to make sure, did you send me this? This doesn't sound like you. So your team is really often the first line of defense, which is why it's so important to take this training and train them well. Make sure that they're using compliance, and you want to make sure you choose the right tools that are compliant. Make sure that they are using the data protection laws so that they're making sure that the client data is just as secure. So you want to make sure you have endpoint protection and antivirus. If you've got staff that works in different locations, make sure they have a VPN and they've got firewalls. So those things prevent and secure your data. Make sure that you have data loss prevention software, have a backup. We have an automatic backup that happens constantly in the background. Security services. So don't try to be your own in-house expert. You want to pay some good firm that will take care of you. And I know that's expensive, but that's money well spent. If you've ever had to pay for a Any of those phishing expeditions or any of that hacking, you will have to pay. And it's very expensive to get your data back if it's been stolen. Review and strengthen your password policies. Number one, that's the first thing you should be doing. Look at what you have in place. Look at what the staff is using, how they're doing it. Look at their MFA policies. Make sure that they've got the MFA turned on. I know a lot of times it's easy not to turn it on because it, oh, it's such a pain in the neck to have to go get that code, but it's definitely worth it. Get a professional to come into the firm and give you a professional cybersecurity assessment. That alone will help you with that. Update your backup strategy, test it. You're backing it up, but if you never test it, you don't know how well that product's working. Run a phishing test with your team in a training session to see how they spot it and how they'll handle it. And encrypt all sensitive bookkeeping data. So these small little improvements in the long run at your firm will create a strong protection. Cybersecurity for law firms is important. It's not just a one-time project where you do it once and you don't ever look back at it again. It's an ongoing process because these things change all the time. It's amazing what they can do now with AI that looks exactly like what everybody else might look like. It really did come from you. So you want to make sure that you are handling that properly. So if you found this video helpful, please like or subscribe to it and Stay with us every month when we talk about law firm finances and best practices. What is your biggest cybersecurity concern right now? Or maybe share a story of something that happened in your firm. I read every comment. So thank you for watching and stay safe and secure.
