Despite what you may think, a cyber-attack is not an elaborate heist with masterminds behind the scenes. In fact, in many cases, it is usually conducted through email correspondence, with the hacker entering the IT system through the ‘front door’ that is often opened by a busy and unsuspecting member of the team.

A scenario that we have seen happen too many times, is a ‘man in the middle’ phishing attack where a fee earner or solicitor opens and clicks onto a link within an email that on the surface appears to be from a trustworthy source, but, in reality, is from a hacker. The hacker can gain the recipient’s trust through the use of a more familiar and well-informed tone of voice, possibly by customising the email to each target’s name, job role or imitating a trusted colleague. However, by the time the recipient has realised something is wrong, it is usually too late, as the hacker is able to entice the recipient to click on the embedded link that is aimed at retrieving confidential details such as names, passwords and logins that could concern themselves, the firm or even the client.

The bait doesn’t stop there though. Email and website spoofing, malicious links and attachments, urgent subjects and calls to action, along with deals that are too good to be true, are just some of the other tactics that can be used within a successful phishing attack. Being able to spot any of these methods can be tricky as the hackers are continuously improving their process with each attempt. It’s therefore extremely important to team up with a reputable legal IT specialist to provide phishing awareness training for your whole team, in order to stay up to date and alert to the forever developing phishing tactics to make your firm less penetrable from unwanted outsiders. In addition to being able to spot the signs of an attack, you must also encourage your team to act immediately and inform someone when they think there has been a breach of data. On average it can take up to 279 days to identify a breach of data, and by that time, irreversible damage can already be done. Creating a safe space for people to come forward will work in your favour- remember the faster you know about it, the faster you can respond to it.

Alternatively, explore how your firm can add additional layers of defence by eliminating the possibility of a phishing attack altogether from the root of the cause – email correspondence. When it comes to what goes in and out of the firm, there is no 100% guarantee of pure security as it’s impossible to truly monitor what is happening in an employee’s inbox 24/7. The best you can hope for is to significantly minimise the chances of getting caught out. In this new age of legal IT, the increasing saturation of various applications coming to market with the lack of interconnectivity could mean hackers have a better chance to exploit a firm’s current defence.

We predict a huge shift towards a completely integrated, secure, cloud-based legal platform, that can act as a utopia for efficiency, reporting and a network effect for the community. These platforms will provide huge opportunities for change and a more secure working environment and by adopting the use of portals, we are set to replace the need for emails as they can completely neutralise the possibility of an attack through the secure hub designed for not only client and solicitor communication, but also a multitude of other reporting and transactional features.

We saw a massive increase in security threats when lockdown initially began, and we predict that this will continue for many firms over the next year. Perhaps now is the time to think about a change in security procedures as well as your team’s mindset and habits – exploring various methods to keep your firm safe is what is needed now.