Law firm cybersecurity and client confidentiality

Which Dallas IT providers understand attorney-client confidentiality requirements?

I do, in the sense that matters for IT. I am Anthony Omini, the owner of Cross River Tech in Dallas, and law firms are one of the industries I work with most. I am not a lawyer and nothing here is legal advice. What I understand is the practical side: a firm has a professional duty to protect the information clients share with it, that duty extends to the computers, email and cloud services where that information lives, and the firm is expected to make reasonable efforts to keep it safe and to understand the technology it uses. The Texas Disciplinary Rules and your own ethics counsel define what that means for you. I translate it into settings, habits and equipment, and I keep them in place month after month.

That translation is the whole point of this article. "Be careful with client data" is not something a paralegal can act on. "Every laptop is encrypted, every login needs a second factor, sensitive messages go out encrypted, and nobody forwards firm email to Gmail" is. Everything below is written so that a managing partner or office manager can read it, check it against their own firm, and know what to ask for.

A word on "compliance." I help firms meet confidentiality expectations, cyber-insurance questionnaires and client security requirements. I do not call any firm "compliant," because that is a judgement for the firm and its advisers, and because security is a state you maintain rather than a box you tick. The broader picture of how I work with firms is on the IT support for law firms in Dallas page.

What does confidentiality mean for your IT, in plain terms?

Strip away the jargon and a law firm's confidentiality duty turns into four questions about its technology. If you can answer all four with confidence, you are in better shape than most small firms I meet.

1. Who can reach client information? Every person with a login to email, the practice management software, document storage, e-signature and the phone system, including former staff whose accounts were never closed, contractors, and any third-party app that was granted access with one click years ago.
2. From where and on what? Firm laptops, personal phones, a home desktop that an associate uses on weekends, a shared computer at a co-working space. Each is a place client data can end up.
3. What happens if something is lost or stolen? A laptop left in a car at a Dallas restaurant, a phone left in a rideshare. Encrypted with a screen lock, the answer is "nothing." Unencrypted, the answer may involve telling clients.
4. What happens if an account is broken into? With MFA, a stolen password does not get in. Without it, an attacker can read every email, every attachment, and quietly redirect a settlement payment.

Everything I set up for a firm serves one of those four questions. The answers are also what a cyber-insurance application asks, what a corporate client's security questionnaire asks, and what you would want to be able to say if a client ever asked how their file was protected. One more point in plain terms: confidentiality includes availability. A file you cannot recover after a ransomware attack or a failed server is a file you failed to keep for the client, which is why backups sit in this article and not only in a disaster-recovery one.

How do you make email secure for a law practice?

Email is where most confidential information actually travels, and it is where most law firm breaches begin. "Secure email" for a Dallas law practice is not one product; it is a handful of settings applied to the email you already have, which for most firms is Microsoft 365.

• Multi-factor authentication on every mailbox. Including partners, including shared mailboxes anyone signs into, with no exceptions. This alone prevents most account takeovers.
• Sender authentication on your domain. SPF, DKIM and DMARC are DNS records that tell other mail systems which servers may send as your firm. Without them, anyone can send an "updated wiring instructions" email that appears to come from your managing partner. Most firm domains I inspect are missing at least one.
• Encryption for sensitive messages. Mail between modern providers is already encrypted in transit. For messages that must not be readable if they land in the wrong inbox, Microsoft 365 Message Encryption lets a sender apply "encrypt" or "do not forward" to a single email, and I can set rules that apply it automatically when a message contains certain content. A secure client portal in the practice software is often the better answer for large or repeated exchanges.
• No forwarding to personal accounts. I block automatic forwarding to outside addresses at the tenant level. It stops both the attorney who forwards everything to Gmail out of habit and the attacker who creates a hidden forwarding rule after a break-in.
• External email tagging. A short "External" marker on every message from outside the firm, so a message that appears to be from a colleague but is not stands out.
• Anti-phishing filtering. Safe Links and Safe Attachments on Microsoft 365 Business Premium check links when clicked and open attachments in a sandbox first.
• Retention and legal hold. Email is kept for the period the firm's policy sets, including when someone leaves, rather than vanishing with their account.

The Microsoft 365 side of this, setting by setting, is in Microsoft 365 security for a small business. For a firm on Google Workspace the equivalents exist and I set those up too.

Why is MFA the single biggest fix?

Because the most common way into a law firm is not a sophisticated attack. It is a password. Passwords get reused across sites, one of those sites leaks, and the same password opens the attorney's email. Or a convincing "your mailbox is full" email leads to a fake sign-in page and the attorney types the password in. From that point the attacker reads mail for weeks, learns which matters involve money, and waits for the right moment to send a change of wiring instructions.

Multi-factor authentication breaks that chain. Even with the correct password, sign-in needs a second proof that the attacker does not have, usually a tap on the person's phone in the Microsoft Authenticator app. It is included in every Microsoft 365 plan, it takes about ten minutes per person to set up, and after the first day people mostly see it only when signing in on a new device or from an unfamiliar place.

Three details make the difference between MFA that protects and MFA that just annoys:

• No exceptions. The senior partner who finds it inconvenient is the account with the most valuable email in the firm. Attackers know that too.
• On every system, not just email. The practice management software, document storage, e-signature, the VPN, the remote desktop server. Each is a separate door into client files unless they share a single sign-in, in which case one MFA covers them and I recommend setting it up that way.
• Old sign-in methods blocked. Legacy protocols can bypass MFA entirely. Turning them off is a setting, and it is one I check on every tenant I take over.

If a firm asks me to do one thing and nothing else, this is the thing.

What should be encrypted?

Encryption turns data into something unreadable without a key. For a law firm it matters most on the things that leave the office and the things that could be taken from it.

• Every laptop. BitLocker on Windows and FileVault on Mac, turned on, with the recovery key stored centrally rather than on the machine. A laptop stolen from a car in Uptown then contains nothing anyone can read. I also set a screen lock that engages after a few minutes, because encryption does nothing while the laptop is open and signed in.
• Every phone that has firm email on it. Modern phones encrypt by default if a passcode is set. The firm's part is requiring the passcode and being able to wipe firm data remotely if the phone is lost, which is what mobile device management in Microsoft 365 Business Premium does without touching personal photos.
• Desktops in the office. Less obvious, but a desktop can be carried out of a break-in as easily as a laptop. I encrypt them too.
• Backups. A backup drive or a cloud backup that is not encrypted is a complete copy of every client file waiting to be read. Backups are encrypted at rest and in transit, and the keys are kept where the firm can find them.
• USB drives and external disks. Better not used for client data at all. If they are, they are encrypted, and the office has a policy that says so.
• Files in the cloud. Microsoft 365, Clio, MyCase and the major document management platforms encrypt data at rest on their side. The firm's job is controlling who can sign in and what they can share, which is the MFA and permissions work above.

Encryption is inexpensive. Most of it is already built into the operating systems and services the firm pays for, and the work is turning it on consistently and keeping track of the keys. That is exactly the kind of unglamorous maintenance a monthly managed IT plan exists for.

How do you stop phishing and wire-fraud attempts?

The attack that costs law firms the most money does not involve hacking anything. It involves an email, at the right moment, telling someone that the wiring instructions for a closing or a settlement have changed. Real estate practices, family law practices handling settlements and any firm with a trust account are targets, and Dallas firms are not exempt. The money is usually gone within hours and rarely recovered.

Defending against it is partly technical and mostly procedural.

• Verification by phone, every time. Any new or changed payment instructions are confirmed by calling the other party on a number the firm already had on file, never a number in the email. This one rule stops the attack even when everything technical has failed. I help firms write it down and put it in the intake packet so clients expect the call.
• Protect the mailboxes attackers watch. MFA and forwarding-rule blocks, as above, so the attacker cannot sit inside a partner's inbox learning when a closing is scheduled.
• Make impersonation visible. External tagging, DMARC on the firm's domain, and impersonation protection in Microsoft Defender that flags a look-alike display name or domain.
• Slow down the click. Safe Links rewrites links so they are checked at the moment of clicking, and a one-click Report Phishing button in Outlook sends suspicious messages to me.
• Short, regular reminders. Not a compliance video once a year but ten minutes at a staff meeting, twice a year, looking at what real phishing aimed at law firms currently looks like: fake e-signature requests, fake court notices, fake client portals, fake "shared document" invitations.
• A plan for the day it happens. Who to call, how to contact the bank, how to preserve the email, and who tells the client. Written before it is needed.

I also watch for the quieter version: an attacker who does not send anything, but reads. Unusual sign-in locations, new inbox rules, and mail being read from two locations at the same time are the signs, and the audit logs in Microsoft 365 show them if someone is looking. Part of managing a firm's IT is being that someone.

How do you protect client data from loss?

Confidentiality includes not losing the file. A firm that cannot produce a client's documents because a server died, a laptop was wiped, or ransomware encrypted the shared drive has a problem with clients, courts and possibly the bar. Data protection for a law firm has three parts.

Backups the firm controls. Microsoft 365 keeps data available, but a compromised account or a synced ransomware infection can delete or encrypt what is there, and recycle bins have time limits. I set up a separate daily backup of mailboxes, OneDrive, SharePoint and Teams stored outside the tenant, plus exports of the practice management data, plus a proper backup of any server with copies kept offline where ransomware cannot reach them. Then I restore a file every quarter to prove it works.

Access that matches roles. Not everyone needs every matter. Permissions in the practice software and document storage are set by role and reviewed when people change jobs. Administrator rights are held by as few people as possible, on separate accounts, so one phished mailbox cannot become control of the whole firm.

Offboarding done the same day. When an attorney or staff member leaves, access to email, the practice software, document storage, e-signature, the VPN, remote desktop, the phone system and the building is closed that day, their mailbox and files are preserved under the firm's retention policy, and any firm data on personal devices is removed. I keep a written checklist per firm because the systems are different for each one and memory is not a control.

Retention and destruction are the firm's decisions; keeping client files longer than the policy requires is its own exposure. My part is making the policy technically true: mail and documents kept for the stated period, and actually gone after it. The infrastructure side, including e-discovery readiness, is covered in document management, backup and e-discovery infrastructure for law firms.

What does a law firm security baseline look like?

Here is the whole thing in one table. It is the baseline I bring every firm to, whether it is a solo practice in Oak Cliff or a fifteen-attorney office in Uptown, before anything more advanced is discussed. Use it to check your own firm or to hand to whoever manages your IT.

Most rows cost nothing but attention. The ones with a monthly cost, endpoint protection and backup, are the two I would not run a firm without, and they are part of how I quote cybersecurity, backup and disaster recovery.

What about cyber insurance and client security questionnaires?

Two outside parties increasingly ask firms to prove their security: cyber-insurance carriers at application and renewal, and corporate clients with outside-counsel guidelines. Both send questionnaires, and both ask about the same short list: MFA, endpoint protection, backups, encryption, email filtering, patching, offboarding, and whether someone is responsible for all of it.

I help firms meet those requirements in two ways. First, by making the answers true. A firm that has the baseline above in place can answer "yes" to most questionnaires without stretching, and the answers hold up if anyone checks. Second, by answering the technical questions with you. Questionnaires are written by security people for security people, and "do you enforce phishing-resistant MFA for privileged accounts" is a question I can answer in one line and a managing partner should not have to research. I keep a short document per firm describing what is in place, so renewal season is a copy-and-paste rather than a scramble.

What I do not do is tell a firm it is "compliant" with anything, or that a policy will pay out, or that a particular control satisfies a particular rule. Those are questions for your carrier, your broker and your ethics counsel. What I can say is that the controls insurers and clients ask about are the same controls that actually stop the attacks, so the work is worth doing regardless of who is asking.

Firms that want the strategic side handled too, such as choosing a document management platform, planning for growth, or deciding what to tell clients about security, sometimes use my IT consulting and fractional CTO service alongside day-to-day support.

How do you get started with me?

Get in touch or call (214) 612-7080. Tell me how many attorneys and staff you have, whether you run Microsoft 365 or Google Workspace, which practice management software you use, and what prompted the call: a questionnaire, a near miss, a new partner who asked questions, or just the feeling that nobody is really watching this. From that I can tell you what I would check first.

For most firms the first piece of work is a review against the baseline above: a day or two, billed hourly, ending in a plain-English list of what is in place, what is not, and what I recommend doing in what order. Firms then either have me do the work as a project or move to a managed plan, quoted per user or per device, month-to-month and cancel anytime, in which the baseline becomes something I maintain rather than something you think about. Remote support is available 24/7/365 with after-hours rates, onsite visits are by appointment anywhere in Dallas–Fort Worth, and nearly all security work is done remotely, so a firm in Plano, Fort Worth or elsewhere in Texas is supported the same way.

Cross River Tech is a small, owner-led company, and I stay your point of contact. That means the person who set up your MFA is the one who answers when an associate cannot sign in from a hotel, and the one who already knows that your real estate practice needs the wire-verification rule in the intake packet, while my team handles the routine monitoring and updates behind me. You never explain the firm twice. If that sounds like the right fit, the related reading below covers the software side in IT support for Clio, MyCase and other legal software.

Questions people ask

Written and reviewed by

Anthony Omini, founder of Cross River Tech

Over 15 years in IT across many industries, now running Cross River Tech, a small owner-led managed IT company in Dallas. Every article is written from his own client work and checked by him before it is published.

Want to know how your firm actually measures up? Tell me how many attorneys you have and what you run on. I will review it against the baseline and give you a plain-English list, in order.

Ask Anthony(214) 612-7080About Anthony