Law firms pride themselves on minding the details and not falling for anyone’s stratagems or schemes. Yet your practice, like every organization, remains vulnerable to cyberattacks such as phishing. This is mainly because anyone — from a senior partner to a summer intern — can slip up and get tricked. Scammers are getting more sophisticated in attempting to scam you, and phishing has become a daily occurrence.
Common scams
Phishing generally refers to fraudulent schemes that cybercriminals use to dupe victims into either:
- Disclosing sensitive information, such as login credentials, or
- Triggering malware that allows hackers to steal, kidnap, corrupt or destroy data.
For example, someone on your staff might receive an email with a link to a “spoof” (fake version) of a legitimate file-sharing site. When the staff member clicks on the link and logs in, the cybercriminals copy the login info and immediately gain access to the actual file-sharing site.
Phishing may also lead to a ransomware attack. Cybercriminals often plant ransomware in email attachments. Again, if the hackers can trick someone at your firm into opening such an attachment, this awful type of malware will burrow into your systems, change the security settings and lock you out.
The perpetrators will then demand a hefty ransom within a stated timeframe to unlock your data. Some may even leak sensitive client information or work product to the “dark web” to show they’re serious.
Your strongest defense
Because phishing is a type of social engineering, your strongest defense against it is training your people. This applies to everyone, from senior partners to entry-level employees to temps and independent contractors.
Some practices design and administer their anti-phishing training programs. Others engage outside providers to conduct the initial training and regularly scheduled follow-ups. If you go this route, look for a reputable company specializing in law firms.
Naturally, every training program will differ slightly. Make sure yours begins by defining phishing and explaining why it’s such a threat. From there, your program should teach employees to recognize telltale signs of phishing — such as suspicious email addresses, urgent language, and odd or unexpected attachments.
It should also include exercises and quizzes to test trainees. Some companies even randomly distribute fictitious emails to see whether employees will fall for a phishing scheme. Between trainings, frequently remind staff to be vigilant.
Grim reality
Training isn’t the only thing you should do to fight phishing. Your law firm also needs a full array of cybersecurity measures, including strong passwords, two-factor authentication and anti-malware software. The grim reality is cybercriminals won’t stop looking for ways to trick your staff, so you can’t stop looking for ways to stop them. Since cybercrime is so prevalent, we will be posting frequently on some of the scams we see so check back soon!