Cyber security: technical measures for solicitors

18/07/2024 14:03:12

Learn about key technical measures to minimise cyber security risks and mitigate potential attacks.

Cyber security is critical for solicitors' practices to protect sensitive information and ensure client trust. Implementing robust technical security measures, alongside organisational awareness, is essential.

Technical tips


  • Need to know: Ensure staff have access to only strictly necessary information based on their roles and responsibilities. Comply with data minimisation principles.

  • Two-factor authentication: confirming new logins to your network through a text message or other means significantly increases security for minimal inconvenience.

  • Access Rights: Ensure all access rights of the staff are revoked and all devices are returned at the end of employment.


  • Data at Rest: Encrypt hard drives to protect data in case of device theft, even in cloud-based setups. Use 256-bit whole disk encryption for robust security.

  • Data at Transit: Encrypt files shared over public networks. Use cloud vendors like Microsoft Office or Google Workspace, and secure the decryption key with high complexity standards.


  • Real Time Protection: Use Anti-Virus Software to detect and delete malicious infections from the internet, email, web sources and portable devices.

  • Keep it Up-to Date: Ensure the software is updated regularly. Restrict the use of portable devices and not opening email attachments from unexpected sources.


  • External connectivity: Use Firewalls to act as a barrier against unauthorised access, especially to networks or the internet.

  • Proper Configuration: Ensure firewalls are regularly updated and properly configured, and centrally managed.


  • Regular Updates: Update all devices, apps, software, and operating systems regularly to patch vulnerabilities and enhance security.

  • Testing Patches: Implement consistent patch management, test patches before installation, and keep records of all updates applied.


  • Access and Storage: Implement access restrictions to IT assets, secure windows and doors, install CCTV, lock laptops, position computers to prevent public viewing, and store files in non-public areas with restricted access.

  • Device Management: Maintain an inventory of work devices, ensure safe destruction of retired devices with stored files, and consider appointing an employee to control the device log. Using the ‘find my iPhone’ or ‘find my Android’ feature will enable you to securely wipe lost devices.


  • Secure Connections: Be aware of public Wi-Fi risks and consider using a VPN, ideally with a mobile hotspot, to protect against viruses, malware, and data interception when working remotely.

  • Device Protection: Use privacy screens to obscure laptop monitors from angles, set all devices to automatically lock after a short period of inactivity, and make this an office-wide requirement.


  • App Usage: Control the use of personal devices for work purposes. Implement a 'bring your own device' policy if needed.

  • Work Phone: Ensure work information is deleted from personal devices at the end of employment, or consider issuing work mobile phones to ensure clear boundaries and security.


  • Storage and Sharing: Discourage portable storage devices, encourage cloud-based platforms for file sharing and storage, and consider on-premises solutions while being mindful of risks and complexity.

  • Device Lifecycle: Be cautious when reallocating equipment between employees, ensure proper cleansing to avoid data breaches, and use professional data-destruction services to minimise  digital footprint and protect confidentiality.


  • Selection and Compliance: Robust file management and security often rely on specialised providers, which may be unable to create bespoke products. Ensure service contracts comply with legal requirements, including data protection laws, and consult relevant resources for guidance.

  • Risk Assessment and Mitigation: Evaluate risks posed by third-party providers, consider encryption and pseudonymisation options, and conduct thorough research on each provider. Perform ongoing risk assessments to address the fact that no provider can offer 100% security.


  • Significance and Context: Conducting a risk assessment is crucial when deciding on the extent of investment and implementation of technical security measures, which must be evaluated in the context of the risk they are intended to reduce through prevention or mitigation.

  • Implementation and Planning: Consider how to implement and carry out a risk assessment, identifying vulnerabilities and developing a plan to respond to a cybersecurity attack.

Implementing robust technical security measures is crucial for solicitors' practices to protect sensitive information and maintain client trust. It’s also important to reinforce these good practices through regular staff training: all your hard work will only be effective if your staff adhere to the precautions that you have put in place.

By following these practical tips and conducting regular risk assessments, law firms can significantly minimise cybersecurity risks and be better prepared to respond to potential attacks. If your budget allows, a third-party company will be able to audit your practices and provide extra peace of mind.

Learn more

This is an abbreviated version of ‘Stress test’, published in the June 2023 Law Society Gazette.