In this solo presentation, Linda Artesani of Artesani Accounting and the Proper Trust outlines the growing cyber threat landscape facing law firms and provides a comprehensive, actionable roadmap for safeguarding client data. She begins by highlighting the prevalence of sophisticated phishing and ransomware attacks, noting the ABA’s finding that 25% of law firms have already suffered a breach. Artesani stresses the importance of employee education and an incident‑response plan as the foundation of any security program. She then walks through concrete measures: securing guest Wi‑Fi, ensuring that firm owners—not staff—are the primary administrators of all software, maintaining a master access list for user permissions, and enforcing strong, unique passwords managed through a password manager (she recommends Practice Protect over LastPass). Secure client communication tools such as Lucio/Elysio are advocated to avoid transmitting sensitive documents over insecure channels. She discusses the role of cyber insurance and how robust security controls (password protection, antivirus, regular software updates, user activity monitoring) are prerequisites for coverage. Finally, she emphasizes ongoing vigilance, regular software updates, antivirus maintenance, and assigning a dedicated cybersecurity lead. The video concludes with a call to action for law firms to engage her firm for comprehensive accounting and security services.
Chapters
Hi there, Linda Artesani, Artesani Accounting and the Proper Trust. Today we're going to talk not so much about accounting, but more about how to keep your data secure at your law firm. Cyberattacks are actually becoming increasingly sophisticated. Gone are the days we could like spot it. Even if you're getting an email, you might not spot that it's a fake email. They've done a really great job at Making them look real. I've seen some ones for Intuit. I've seen someone for— some of them for Chase Bank. And if you really look at the email that it's coming from and kind of expose the actual email, you'll see that it's not real. And they always have links. That's usually your first trigger is you'll see a link that they want you to click, or they'll say verify your Social Security number here. And that just leads down that rabbit hole of maybe being hacked or ransomware, you know, your information out on the dark web. Things you don't want to happen at your firm. And so these are often carried out by people trying to steal your information and then they resell it. Even the Bar Association has cited that this is an urgent concern for law firms. And according to the ABA, 25% of all law firms have experienced a data breach. And really, that's a lot of law firms. And I can tell you myself, with working with some of these firms, we've run into some. I mean, we work with quite a few firms, but we've run into quite a few firms that have had either a ransomware attack or a data breach, or something that's brought the whole system down, and you really don't want to have that happen. Best way to make sure, or keep, keep that at bay and protect yourself, is to really inform everybody at the firm and put parameters in place for making sure that this doesn't happen. And if it does, have that emergency plan in place. It's really the best information or best Best advice I could give anybody at a law firm, and this is stuff that we do at our firm. We advise on some of these topics. It's not just accounting and data. Sometimes we have to go down into this kind of a topic because it affects all of us at the firm, even people that work outside the firm. I've had some firms that I've worked with that have had their account, their bank accounts hacked, and it's a horrible thing. You have to actually stop and open up a new bank account. You have to work with the bank, and then if there's checks out there, it can make a giant mess. So you want to Avoid that at all, at all possible. So a few of the things to think about: Do you have shared Wi-Fi? A lot of law firms do have shared Wi-Fi. They have that extra, you know, they'll have people come in the office and they're waiting, and they can log in as a guest. Make sure that that guest, even the guest protocol, is very secure and set up properly so that they're not logging into the firm's Wi-Fi. You never want that to be in place. What kind of software are you using at the firm? And that's one of the biggest places where we see security weaknesses. Desktop software, believe it or not. I know a lot of people like, oh, I don't want my stuff online, but desktop software is one of the first places. It's an easy place to permeate. If you have a network set up and you hopefully have a firewall, it's important to have a firewall. It's really essential in that network. System, the security system that you have, that barrier in place that's hard to permeate. But if you're using software, it's important that you know who in your firm is the primary admin or the master admin, or just the owner of the software, especially if it's desktop. I've seen it happen over my career where maybe the bookkeeper was the one that got the software registered in their own name. I've seen it where one of the bookkeepers passed away, and it was really difficult to get that license over. The data was inside. So you wanna make sure that you have only the business owners are the ones that own the software or are listed in the cloud software as the primary admin. Make sure that that's set up. A lot of times it's just easy. The, you know, the attorneys or the partners are busy, and they just go, yeah, yeah, set it up. Then you find out you don't even own the software that all your data is sitting in. You don't want that to happen. It's really hard if you are not your primary admin at your firm to get that back if the person doesn't want to give it back. It's a lot of steps, and it actually sometimes has to go to court. You don't want to have to go through all that. You should never be an admin. It should never be a legal secretary. That's the own— you know, it should always be the owner of the firm that owns the software. The next thing you want to look at is who has access to the software and make sure you keep a list. It sounds like, oh, another step, another list, something else I have to take care of. But you want that master list to know who has access and what their access is and what's involved. I usually recommend to firms, you know, accounting@xyzlawfirm. So that way, if somebody leaves the firm, you still maintain that email. You don't have to go in and make a new account, new user. All those settings are set up, but now you just change the password. And once the person moves on to their next job and you're getting somebody new, and then you give them access to it. That way you're not having to reinvent the wheel all the time. But make sure you know who has access to what software. It's really critical to keeping the reins on security. Next thing I wanna talk about is passwords, because I have seen and worked with many firms where their password is, believe it or not, password123. No, never, never, never. Or something so basic and generic that anybody could crack that nut. So you wanna make sure that you have a password that's complex. Get a good password manager that's gonna be able to store all those passwords so that you're able to keep track of the passwords, and, and you have access in case you need to unlock a password. You have access to that. LastPass is the one we, we used to use at our firm. Now we use Practice Protect. Highly recommend that company for password protection. It is It's for serious users. And if you think about it, you've got a lot of data. You want to securely protect the data as, as that person that holds the data with a law firm. We use Practice Protect at our firm. We also use Licio for client communication and messaging because we don't want to be sending sensitive documents over the, over the the web. It's just not a great practice. And if you can have a product like Elysio, like a Practice Protect, those are software you pay for, and you also go through a lot of extra steps to be certified in them. But when you go to buy your cyber insurance, it's going to be a lot easier. And you have to go through a lot of steps, leaps, and hurdles to go through cyber insurance and to get cyber insurance set up at your firm. It's not just, I want this and pay for it. They will come and see how you're doing. They'll give you that cybersecurity kind of an overlook to see how your firm is set up and what you're doing in the practices. They're going to want to see how are you protecting passwords, how are you protecting client data. So it's really important that you have it set up with the right protocol. You really don't ever want to go through a breach. It's a time— it'll take a lot of your time. You will lose days of work. You're going to be paying people. It's going to be very expensive not to have this in place ahead of time. Believe me. Trust me. You will be happy that you took the steps to do this. Have a good antivirus program. Really important to have that antivirus program. I use— we use Macs. We have Malwarebytes, but there's plenty of them for PCs. You really wanna look into the best one. I know I used to use Norton. I'm sure that's still out there. Just do your research to find out which one's the best to use. Even, even comes down to you log into Chrome, and if you look up and next to your picture it says paused. That's because they've done some security updates in the background. You wanna relog in every single time, stay up to date with all of your products. Don't just hit cancel because you don't wanna update. I've seen that a lot with QuickBooks. People like just wanna jump in and work. And the old desktop program, you used to have to update it all the time because they were constantly working on security and people would just go buy that box and go, ah, do it later. And they never did it. And that's bad. You wanna make sure that you have it done, especially if you're using desktop software. Make sure you update it regularly. It just keeps your product to the latest version so it works properly, but it will also help you make sure you can protect your firm against security problems. You can monitor user activity, whether it's somebody using the website or even users in the office, see what's going on behind the scenes. You do have the right to do that. You have to let them know, but you just, you can monitor the user activity. And the most important thing, I think, Really, as I wind down this video, most important thing is you just need to educate your employees about security issues. Stay on top of it. Stay on top of security updates. Malwarebytes gives a lot of updates. You can sign up for a lot of places where you can stay in touch with whatever software you're using and whatever recommendations they have for your specific type of law firm. But just stay on top of it and then educate your employees on if they get that suspicious email, don't click any links. And make sure that they understand that. Of course, if you take them out of email and put them in Lucio, you don't have to worry about that, because now you're in an invite-only space. They won't be clicking anything dangerous. But if they do see something that seems suspicious or out of line, or just looks different, have them report it to the person in charge, making sure you assign somebody to be in charge of all the cybersecurity in your firm. It's just important to have, and really imperative to have some kind of protocol in place when you're, you know, you're working in the space that we work in professional services, and we have a lot of data that we really have to protect. And I think that just taking the time to have a plan in place, a list of who's using the software, a list of the user permissions, have a protection on your passwords. Those are all things. Have the insurance. These are all things that will get you in a good space so that you are looking to really keep your data secure at your law firm. So I hope this was helpful. I hope it planted a seed or 2 about maybe getting that set up. It's something we talk about with our clients. So if you're looking to hire a firm that not only does the accounting but does much more, has much more of a larger reach with financial strategy and even these kind of things, when you're talking about keeping the, the law firm secure, it's important. Reach out, we're available. It just One contact form away, and I hope you all have a wonderful, wonderful day. Bye now.
