According to the ABA’s 2018 Cybersecurity Tech Report, 69% of lawyers in the U.S. use public Wi-Fi to access client data, but only 38% are using an encrypted connection. Clearly, mobile security isn’t always front-of-mind for all lawyers.
Understandably, information governance isn’t exactly a big part of the law school curriculum. But with high-profile data breaches affecting law firms regularly making the news, as well as the wealth of confidential client data firms are sitting on, lawyers can no longer afford to sit idly and hope for the best.
Mobile lawyering offers a range of benefits, but for a more successful and ethical mobile practice, you need to ensure your mobile device is secure.
Security is very important to us at Clio. To protect user data:
- We’re audited every day by McAfee Secure to help ensure your data is protected from security vulnerabilities and other online threats.
- Our privacy policy has been reviewed by TRUSTe for compliance with their program requirements, including transparency, accountability, and choice related to the collection and use of your Personal Information.
- All information travelling between your browser and Clio is protected with 256-bit Secure Sockets Layer (SSL) encryption and is validated by Norton by Symantec.
- We have multiple servers backing up your data in real-time to provide geographic redundancy (i.e., if a server in one location fails, the server in the other location will still keep your data intact).
- And more.
However, there’s a limit to what your legal practice management provider can do to protect your data—there are also key steps you need to take yourself.
It’s your practice on the line, so please take action on the mobile security tips in this list immediately if you have not done so already.
The importance of mobile security for lawyers
Joe Kelly wrote an article with Law Technology Today suggesting that lawyers specifically are doing many things to compromise their firm’s security. These include opening attachments from unknown senders, using poor software solutions, and storing unencrypted firm data directly on their devices.
That’s a problem, as cyber threats are on the rise for mobile devices. In fact, many of the greatest cyber threats target mobile devices specifically, with attacks designed to track location and monitor text messages, emails, and even screen activity.
But it’s not just malware that puts firms at risk. Mobile devices are easy to misplace or leave behind—and they’re easy to conceal. It’s not that uncommon to forget a phone or tablet in a cab, leaving your clients’ data vulnerable.
This is more common than you might think. According to a report from Bitglass, 25.3 percent of data breaches in the financial services sector since 2006 have been a result of lost or stolen devices.
Tips to secure your mobile phone
“Tips” might be a bit of a misnomer. Without taking the proper precautions, lawyers who work on mobile devices may be inadvertently leaving confidential client information at risk of public exposure.
However, by taking a few key steps—and by keeping a few rules in mind—you can secure your mobile devices and know you’re keeping client data safe.
1. Use common sense
This might seem fairly straightforward, but it’s worth mentioning: Be careful when working with client information in public. This alone will go a long way towards keeping your mobile device secure.
Don’t speak loudly about the details of a case, and don’t work where others can easily look over your shoulder (you never know, opposing counsel could be sitting right behind you).
2. Password protect your phone (and tablet and laptop)
This is a basic step, and you need to do it now if you haven’t already.
Which brings us to step three …
3. Use strong passwords
Your password shouldn’t be your first name, or 1234, or anything else that someone trying to get access to your data could easily guess. Ideally, your password should have:
- A mix of numbers and upper and lower case letters
- More than 12 characters
- A passphrase (include all the spaces in between)
A password manager, such as KeePass, can help you keep track of tough passwords.
4. Use two-factor authentication
Even the strongest passwords can be hacked. That’s why it’s a good idea to enable two-factor authentication for an extra layer of security for all your accounts.
Two-factor authentication requires not only your password, but a temporary code that gets sent to your mobile device as well, via text message, or the Google Authenticator app. The temporary codes update—if someone tries to access your account by guessing your password, but they don’t have your mobile phone, they won’t be able to access your account.
What the Google two-factor authentication app looks like.
While we say “extra layer of security,” the practice of adding two-factor authentication is becoming fairly standard. If you’re a Clio Manage user, we recommend encouraging all users at your firm to use Google two-factor authentication to access their accounts.
5. Encrypt your devices
Encryption might sound technical, but the good news is some newer phones are already encrypted by default. Check with your phone manufacturer to see if it’s already encrypted or not—otherwise, it’s fairly easy to encrypt your mobile device.
First, make sure you have a lock-screen password (see notes on strong passwords above). This is your first line of defence—if someone gets a hold of your device, they won’t be able to access it without your password.
Second, enable encryption on your device. It’s simple: Just follow the steps on your provider’s website:
If you have an Android device, instructions will vary depending on the phone you have. Look for instructions on how to turn on encryption on the phone manufacturer’s website, or simply search online for articles outlining the steps.
If you haven’t done this yet, do it now. Right now.
Don’t stop at your mobile device. Encrypt your laptop hard drives and USB drives as well:
- Encrypt your Mac’s hard drive by turning on FileVault.
- Encrypt your PC hard drive by using the professional version of Windows (device encryption should be automatically enabled, but you can double-check with these steps).
- Encrypt USB drives using Bitlocker.
To be clear, if you’re using cloud-based tools on your mobile devices—such as a cloud-based practice-management solution like Clio—your data will be extremely secure (see the measures we take above). For some, it simply might provide additional peace of mind to invest in another security tool.
Learn more about law firm data encryption.
6. Communicate via secure channels
Now that you’ve encrypted all of your mobile devices, you’ll need to make sure you’re communicating via secure channels as well.
When sending client data back and forth, unencrypted messages and emails are vulnerable to interception. It’s best to use a secure portal like Clio for Clients to share client information, and a secure messaging app like the Signal App from Open Whisper Systems to send short messages.
7. Have a BYOD policy
If you’re working with partners, associates, or staff, they may be using their personal mobile devices to do work and access firm data. You need a Bring Your Own Device (BYOD) policy to govern how this works—and what to do in the event of a data security breach.
At a minimum, your policy should require that:
- All lawyers and staff use firm-specified services to work with client data. There are over 2 million apps out there, many of which can help make your working life easier. But not all are safe to use with client data. Choose wisely, and make sure the rest of your firm respects those choices.
- All devices have a remote wipe option enabled. If someone steals your paralegal’s phone, what do you do? You need to be able to remotely wipe all data from the device to protect sensitive client information.
- All devices are encrypted. Again, this is super important. You should encrypt data on any and every device you work with client data on.
8. Keep apps and operating systems up to date
Older apps and operating systems are more vulnerable to attack. Consider: Israel’s NSO group was at one point selling software that could spy on iPhones without being detected. Passwords, emails, text messages, phone calls, and even the location of the phone were all put at risk—for those who hadn’t upgraded their iOS software.
Always. Update. Your. Apps.
9. Back up firm data
Finally, always back up your firm data to an encrypted location. This way, you’ll have access to most of your data in the event of a ransomware attack.
Ransomware infects your computer and encrypts all of its data. A hacker then demands payment to unencrypt the data. Maybe they’ll unencrypt the data if you pay them. Maybe not.
In addition to keeping your firm’s data more secure, this will provide a backup in the event that your phone and laptop happen to die on the same day. Backups should be done weekly, at a minimum, and should ideally be automated.
These mobile security tips are a great starting point for keeping your mobile law firm secure, and you should definitely take action on all of them now to ensure your client data is protected.
That said, make sure to do your own research and find other ways of keeping your mobile practice secure as well. Technology changes much faster than the law, but by staying one step ahead with your security standards, you can enjoy peace of mind while running a mobile practice.
We published this blog post in November 2016. Last updated: .
Categorized in: Business
